AI Just Broke PHP — And Every Website Owner Should Care

This week a story moved through the dev world that should make every business owner sit up: a serious bug that had been hiding inside PHP for 14 years was surfaced with the help of AI. Fourteen years of human code review, missed. Days of machine review, found.

Why PHP matters more than you think

PHP is the unglamorous engine under a huge share of the internet — WordPress, WooCommerce, Magento, and millions of custom business sites. Roughly 70% of websites whose server technology can be identified run on it. So a core PHP bug isn't a programmer problem; it's a "your website, your leads, your checkout" problem.

The real lesson isn't the bug — it's the auditor

Humans review code the way humans do everything: with limited time, tired eyes and assumptions. AI reviews code the way water finds cracks — everywhere, patiently, without embarrassment. Every legacy system on earth is full of "sleeping" issues that nobody has had the hours to hunt. That hunting just got cheap and fast.

And it cuts both ways. Defenders can audit everything now — but so can attackers. The gap between "a bug is discovered" and "a bug is exploited at scale" is shrinking to days. The businesses that get hurt won't be the ones with old code; they'll be the ones with old code and slow update habits.

What to do if your site runs on PHP

• Update PHP itself — if your host still offers 7.x, you're exposed and slower. Move to a supported 8.x version.
• Patch the CMS and plugins — most real-world breaches walk in through an outdated plugin, not the core.
• Turn on a firewall/WAF — Cloudflare's free tier blocks a surprising amount of automated exploitation.
• Backups you can actually restore — an untested backup is a hope, not a backup.
• Ask for an audit — AI-assisted reviews are now fast enough that "we can't afford an audit" stopped being true.

My take

AI didn't "break" PHP — it exposed how fragile our collective maintenance habits are. The winners of this era won't be the people with the newest stack. They'll be the ones who maintain what they have, ruthlessly, with machines doing the boring watching. That's true for code, ads and SEO alike.