Decades-old critical flaw uncovered in PHP software used in 70% of websites
Researchers used AI to uncover vulnerability that went unnoticed for decades
LOUISVILLE, Ky. (WDRB+WAVE) — Tech administrators are updating systems after a flaw was discovered in PHP software used by 70% of websites worldwide. The flaw went unnoticed for decades until researchers, aided by artificial intelligence software, identified it.
The vulnerability in PHP software allowed attackers to run their own code in a compromised site. PHP has issued a patch fixing the system, but officials say it will take time for the problem to be fully fixed.
University of Louisville computer science associate professor Adrian Lauf wasted no time updating his systems.
“As soon as I saw it come across and PHP was on it, I mean, they’re, I think they’re being a little bit gracious when they’re marking at a 9.8 out of 10. It’s like a 15 out of 10,” Lauf said. “It gives you access to everything on the web server, which means I can now change the sites that you’re displaying. I can start collecting people’s credit card information. I can siphon off all the information that’s being typed in, passwords, whatever. I can grab all that. I can modify the website.”
As news of the PHP vulnerability spread, the impact became clear. Seventy percent of websites across the world use PHP.
“The big problem is that it’s already in the wild, and people have figured out already just based on simple descriptions how to take advantage of it,” Lauf said.
Researchers identified the vulnerability, and the company has already issued a fix. But Lauf said the vulnerability will not disappear completely. Older websites may not be able to be fixed.
“They are so obsolete that the patch was never published for their versions of PHP and for the operating systems they’re running,” Lauf said.
The software’s code has been public for decades, but artificial intelligence helped find the problem human eyes missed.
“There are so many of these things coming to the forefront that are 10, 20 plus years old, in a large part because there’s more eyes on stuff than ever before, but because also large language models can audit code bases at an unreal pace,” Lauf said.
Security groups are working to close the gap before attackers use the technology for harm.
Consumers should not panic. They may wish to run a manual update of software on their devices.
Copyright 2026 WDRB+WAVE. All Rights Reserved.
