Old code, new risks
On 21 October, PHP rushed out urgent fixes for two serious flaws. PHP runs behind WordPress and an estimated 70% of websites, and the flaws could let a stranger take over a site's server without logging in. Some government websites in Europe went offline while they were patched.

The flaws were found with AI. One security firm, Calif, found them as part of OpenAI's "Patch the Planet" initiative, and another, Wiz, found them separately. Then, the day before the fix came out, Calif accidentally posted a video of the attack working. It was taken down, but the race to patch was on.
These flaws had been sitting in the code for years. AI is what made them dangerous, and the same tools are open to people who want to cause harm. Old software is only going to get more exposed, so keeping systems up to date is no longer housekeeping. It's the job.



