That cheap business website runs on code AI just cracked open

PHP, the scripting language behind an estimated 70% of the world’s websites, has just been hit by two critical vulnerabilities. Details leaked a day before the planned release, which forced an emergency patch and a global scramble to take systems offline. AI found the flaws, and that matters more than the bugs themselves.

For New Zealand business owners, the lesson is blunt. The $2,000 WordPress site a contractor built in 2019 was never a one-off cost. It is a piece of infrastructure with an attack surface, and AI has just shortened the gap between a flaw existing and someone exploiting it.

Decades of hidden flaws, cracked in a week

Security firm Calif, working with OpenAI, found one of the flaws using the GPT-5.6 Sol model during an OpenAI-funded code audit. Google-owned Wiz found them independently weeks later with its own autonomous AI tool. OpenAI said the discovery “marks a new phase, where AI can find security bugs with internet-scale impact.”

Wiz says the flaws had been present for decades. They survived because proving they could be exploited took an exceptionally complex chain of steps. Frontier AI removed that barrier. In Wiz’s words, “A single researcher completed in a week what previously would have taken a world-class team months of work.”

The bug itself is about as bad as they come. Security consultant Davi Ottenheimer told Wired it sits “in a file upload interface that’s like a front door with no lock.” An attacker doesn’t need a password, an account, or even to know what software a site runs. One crafted upload to any server they find is enough.

This is not a one-off. Vulnerability disclosures in 2026 are on track to roughly double 2025’s record, and that surge is driven by AI models being turned on old code. The same tools that write your marketing copy are now auditing the internet’s plumbing, for researchers and attackers alike.

Governments didn’t wait to find out

The institutions with security teams reacted fast. In the Netherlands, the Port of Rotterdam, the DigiD digital identity service, hospital websites and the sites of the five largest political parties went offline. Denmark’s Kombit shut services including the national school communication platform, and Finland’s Valtori pulled government network services as a precaution.

The FBI warned operators to take sites offline if they cannot patch immediately. The UK’s NCSC, alongside agencies in the EU and Australia, said that “where immediate remediation is not feasible, organisations should consider taking the system offline.”

Tiffany Farriss, interim chief executive of the Drupal Association, summed up the scale: “All servers using any version of PHP released in the last 20 years will be vulnerable. This issue impacts the majority of the Internet.”

Lukasz Olejnik of King’s College London warned that exploitation could follow “a minute or so” after disclosure. His worst case is wormable malware spreading across big chunks of the web.

The website nobody owns

This is where the story reaches the average Kiwi SME. Most small websites are run by owners with no security staff, often on shared hosting where they don’t manage the server and may not know who updates PHP. Worse, WordPress security firm Wordfence has warned that usual automatic updates will not apply this fix. Someone has to act manually.

No New Zealand outage has been publicly reported yet. But PHP’s global share and the popularity of WordPress, Drupal, Joomla and Magento among local businesses make meaningful NZ exposure almost certain. That includes e-commerce stores taking card payments, booking systems holding customer data, and the countless sites a nephew or offshore freelancer built and nobody has touched since.

The risk isn’t just downtime. Remote code execution can expose customer databases, and that opens a business to Privacy Act notification obligations, reputational damage and, for anyone selling online, lost revenue. A website that “just works” is only cheap until it becomes the way into your systems.

What to do before Friday

This needs a phone call, not a strategy offsite. Ask your web developer or hosting provider three questions. What PHP version is my site running? Has the emergency patch been applied? If not, when, and who is accountable? If nobody can answer, you have found the real problem.

Longer term, businesses need to treat web infrastructure like any other operating cost, with a maintenance contract, a named owner and a patching expectation measured in days, not years. AI isn’t going to slow down, and the next decades-old flaw is probably already being found. The firms that come through will be the ones that knew who to call.

Sources

• NZ Herald: PHP issues – Websites go dark worldwide as AI exposes critical security flaws (2026-10-21)
• RNZ: Government websites go dark after AI-discovered flaw sparks security scramble (2026-10-22)
• Wiz: PHP2Shell – AI uncovers critical RCE vulnerabilities affecting 70% of the Internet (2026-10-21)
• Investing.com: Explainer – What is PHP and why did it take government websites offline? (2026-10-21)
• BBC: Websites taken down worldwide as critical PHP cyber-security update issued (2026-10-21)
• Wired: This Is Not A Drill – Critical PHP Vulnerabilities Are Setting the Internet on Fire (2026-10-21)