A 20-year-old PHP bug forced sites offline and exposed AI's cyber threat

A 20-year-old bug in PHP, the scripting language that still powers a large share of the web, forced major websites offline and exposed the growing threat of AI-powered cyberattacks. The vulnerability had been sitting in plain sight for two decades, a quiet time bomb in code that millions of sites depend on every day. When it was triggered, the impact was immediate: major sites went dark, and security teams scrambled to contain the fallout.

For executives, the episode is a case study in how the internet's oldest infrastructure can become its biggest liability. PHP was created in the mid-1990s, long before cloud computing, mobile apps, or machine learning were on anyone's roadmap. Yet it still runs a staggering share of the web's back end. The bug was not a niche issue in an obscure library. It was a core flaw in a language that has been a default choice for developers for decades.

The incident also put a spotlight on the changing nature of cyberattacks. The source report notes that the outage exposed the growing threat of AI-powered cyberattacks. That is not a distant concern. AI tools can now scan codebases for vulnerabilities at machine speed, craft phishing campaigns that mimic a CEO's writing style, and adapt malware on the fly to evade detection. A bug that might have gone unnoticed for years in the past can now be found and weaponized in days.

For companies running PHP, the immediate lesson is operational: inventory every server, check for unpatched versions, and treat legacy code as a first-class security risk. But the deeper lesson is strategic. The internet is built on layers of software that were never designed for the threats they face today. Every company is a technology company now, and every technology company is a security company. That means the cost of ignoring maintenance is no longer just a technical debt problem. It is a business continuity problem.

The response to the bug also matters. When a vulnerability of this scale emerges, the speed of patching determines the damage. Organizations that had strong visibility into their systems and automated patch management were likely able to recover quickly. Those with sprawling, undocumented infrastructure faced a harder path. For boards, this is a governance issue. Security is not just an IT department concern. It belongs on the risk register, alongside financial and operational risks.

There is also a broader economic angle. Major outages carry direct costs: lost revenue, overtime for engineers, and potential liability to customers and partners. But the indirect costs can be larger. Trust is fragile. A company that goes dark because of a 20-year-old bug may find that customers and investors start asking harder questions about its technical foundation. In a market where every business is being valued partly on its ability to operate reliably, a single outage can reshape perceptions.

Finally, the AI dimension deserves board-level attention. The same AI tools that are transforming productivity are also lowering the barrier to entry for cybercriminals. The source report frames AI-powered cyberattacks as a growing threat, and this incident is an early warning. Executives should assume that attackers will use AI to find the next bug faster than humans can patch it. That shifts the security calculus from 'if we get hit' to 'when we get hit, how fast can we respond?'

The 20-year-old bug is a reminder that the internet is not a finished product. It is a living system, held together by code that was written before many of today's employees were born. For the executives reading this briefing, the question is not whether your company has legacy vulnerabilities. It almost certainly does. The question is whether you know where they are, who is watching them, and what happens when someone with an AI assistant decides to exploit them.