A PHP flaw hit even current versions, so patch speed mattered more than age

On The AI Daily Brief, a host covered a newly disclosed flaw in PHP, a programming language from the early 1990s that runs the servers behind much of the web. The episode, "The AI vs AI Battle for the Internet" (22 October 2026), showed that age was no protection, because current software was exposed too. The contest was over response speed. A separate post read on the show warned about forgotten projects.

What was said

The flaw, nicknamed PHP 2 Shell, lets an attacker take over a server without logging in. Researchers judged that as many as seven in ten sites and web apps might be exposed. The host stressed that the newest versions were vulnerable as well.

A researcher at Calif found it about two months earlier using an AI model, and the security firm Wiz found it independently. OpenAI then worked with PHP's maintainers on a fix. The host said word of the exploit still spread about 10 hours before disclosure. The NSA advised organizations to go offline until they were patched. Volker Dusch, a security engineer at the nonprofit that maintains PHP, called it the most severe issue the language had faced in over a decade.

The show also covered breaches at the hosting service Railway and at OpenCode, where attackers took API keys. Dax of OpenCode replied to Railway, and the host read his post: "Any old projects you've long forgotten about will be found and used against you." Separately, Kenny Lauderdale posted that about fifteen years of old sites could now become lost media. The show listed sites that went read-only or offline.

Why it matters

Our reading: these two threads meet at response time. Dax wrote about stolen keys, not PHP, so the link between them is ours. A fix existed at once, yet owners still had to act within hours. A project nobody owns cannot act at all.

For managers, that makes a list of everything you run the first job, including old sites and the keys behind them. Entrepreneur John Ennis wrote that his team rotated every key across a large number of projects very quickly, which would once have been a nightmare. Our inference is that knowing what you run makes such a sweep possible.

The other side

The PHP story is not about neglect. Even well-kept, current installations were vulnerable, and the show did not present the flaw as an example of forgotten code.

Much of the alarm came from social media posts. These included claims that many sites may already be compromised and that agent swarms were hacking half the internet. The host admitted a reflexive skepticism toward such warnings, but said this one seemed real. The seven-in-ten figure is an estimate of possible exposure, not a count of breaches.

Ennis also argued that defense is underrated, because unlike nuclear weapons, AI attacks can be countered with AI. The show did not say whether owners of forgotten sites will have such tools in time.