Most of us never think about the code behind the websites we use. Banking portals, online shops and business apps all sit on layers of software we rarely see. PHP is one of those layers.
This October, researchers disclosed two critical flaws in PHP that had been sitting there since version 5.4, which came out in 2012. Both could let an attacker run commands on a web server. Emergency patches were released on 21 October.
AI did not plant these bugs. They were already in the code. What changed is how hard they were to use. Turning them into a working attack took a long and complicated chain of steps, and for years that difficulty acted as a kind of protection. Researchers at Wiz said frontier AI models lowered that barrier substantially.
Attackers did not wait politely. Amazon's threat intelligence team recorded an attack attempt on 17 October, four days before the fix became public.
The reach is large. About 69% of websites with a known server language run PHP, including sites built on WordPress, Drupal and Joomla. Some sites, government ones included, went offline for a while as teams applied the patch. The fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older are no longer supported, and only got source patches.
The same tools that help attackers help defenders too. A developer can use AI to review code, catch insecure patterns and test fixes. But we can no longer assume a system is safe just because it is hard to break into. That comfort is wearing thin.
For Malawi and the rest of Africa, this matters more each year. Lenders, payment platforms, hospitals and government offices are moving online, and a hacked system can leak customer data, halt operations and cost people their trust. Many small teams do not have a security person on staff. AI can help them check their code earlier and more often, as long as someone tests what it finds. It misses real flaws, flags false ones and sometimes suggests fixes that create new problems.
So what should you do now?
- Update PHP to a patched version, or ask your hosting provider to confirm they have.
- Stop running PHP versions that are no longer supported.
- Review your security regularly, not just once before launch.
- Keep your dependencies, backups and access controls in order.
- Test every AI finding before you trust it.
AI has not made the internet less safe. It has shown us how much we did not know about the systems we depend on. What matters now is who finds the next flaw first.