The PHP crisis has become one of the biggest internet security scares of the year, and I think everyone who builds, owns, or uses AI-powered websites should be paying attention.
A dangerous weakness that had been hiding in website software for more than a decade is now being tested by hackers across the internet. Cloudflare has seen millions of attack attempts. Governments have taken websites offline. Even some well-protected services have had to act quickly.
And the really frightening part? You could have a perfectly normal-looking website, with everything working as usual, and still have no idea that the software behind it needs an urgent security update.
I wouldn’t panic. But I certainly wouldn’t ignore this.
There are already ways to protect yourself, and some of the newest AI security tools can make the job surprisingly easy.
AI Found Something the Internet Had Missed for 14 Years
PHP is the software running behind millions of websites, including many built with WordPress. It helps websites handle payments, accounts, private information, and other important functions.
Researchers found two serious security holes inside PHP itself. Both were rated 9.2 out of 10 for severity.
Under certain conditions, hackers could use them to run harmful code on a website’s server without even logging in. Your website could be at risk despite having strong passwords and carefully written code.
What makes this story unusual is how the flaws were discovered. Researchers used powerful AI models, including OpenAI’s GPT-5.6 Sol, to help uncover problems that had gone unnoticed for years.
The same AI technology can help attackers look for weaknesses faster, too. That is why the response has been so urgent.
There’s an important difference between an attempted attack and a successful breach. Millions of attempts have been observed, but those numbers don’t mean millions of websites were hacked.
The immediate priority is finding out what’s exposed and fixing it before someone gets in.
Inside the full guide, I will tell you how to check your own website, use OpenAI and Cloudflare’s security tools, protect AI agents and connected accounts, and set up simple safeguards that keep working after this crisis.
Read more
