Two flaws in PHP, the language that still underpins more than 70 percent of the internet, forced organizations worldwide to take sites offline in October 2026.
The bugs had sat dormant for over a decade. Security researchers say the vulnerabilities were considered too complex for humans to exploit, which is exactly why they went unnoticed for so long. That changed when AI assisted discovery tools surfaced them.
Governments, banks, and telecommunications providers reacted quickly, pulling systems offline rather than risk exposure. Attackers moved just as fast. Exploit attempts climbed from a few thousand to several million within hours of disclosure.
The most alarming number is the patch rate. As of late October, only about 13.8 percent of PHP installations had applied the fix. That leaves the overwhelming majority of the web still running vulnerable versions.
Security researchers are treating the episode as a turning point. The gap between how fast AI can find a flaw and how fast organizations can patch it is now the single biggest variable in internet security.