Most Websites Share the Same Foundation, So One Bug Puts Them All at Risk

Specialists who track internet security uncovered an alarming problem about two months ago and tried to keep it secret while a fix was prepared. This week, the problem was disclosed: two flaws in PHP, software built decades ago that supports roughly seven in ten websites. Businesses and governments then scrambled to respond before hackers could get in.

PHP works out of sight. It helps the computers that store websites build pages, handle logins, and send results to a browser. Because so many sites rely on the same code, a flaw there reaches a very large share of the web.

Kevin Roose, co-host of a podcast about artificial intelligence, said researchers found the flaws. He said an attacker could gain control of any computer hosting a website “without a password and without leaving any fingerprints.”

To show what shared risk means, Roose offered this comparison: “imagine that 70% of the doors in the world ran on the same locks.” The flaw is in the shared PHP code, so every site running it is exposed.

Researchers used AI to find the flaws, Roose said. He added that AI tools can also quickly exploit holes like these. That has created a race in which defenders try to install patches before intruders get in. Operators need to patch every system running PHP, including older versions.