The Internet Has a Plumbing Problem.

There’s a building somewhere with a new lobby, expensive furniture, and one of those coffee machines that requires a five-minute orientation. The walls are freshly painted. The lighting was probably approved by a committee. The brochure promises a “reimagined experience.”

Behind the walls, a pipe from the early 1990s is thinking about retirement.

The internet has a lot of buildings like that.

PHP, the programming language behind an enormous amount of the web, has been doing the unglamorous work for years. WordPress relies on it. So do Drupal, Joomla, and plenty of other systems that keep businesses, governments, and the occasional disastrous restaurant website online.

Then researchers at Wiz found serious weaknesses in PHP itself. Not just a bad WordPress plugin or a carelessly chosen password. The plumbing. They used advanced AI tools to make the kind of complicated security research that once took extraordinary time and expertise much more practical.

In October 2026, PHP released patches. Before the dust could settle, security companies reported millions of attempts to exploit the flaws. Attempts, mind you. That is not the same thing as millions of successful break-ins. But it is still enough to make the building superintendent cancel his weekend.

There’s a peculiar thing about a vulnerability that has been sitting quietly for years. It doesn't need to get worse to become dangerous. The people examining it just need better tools.

A locked cabinet that defeated every amateur locksmith in town might look impressively secure. Then somebody invents a pocket-sized lock-picking machine. The cabinet hasn't changed. The odds have.

AI is beginning to change those odds across software. It can help defenders discover and repair dangerous weaknesses faster. It can also make it easier for attackers to look for the same weaknesses. The tools don't come with a little morality switch.

That leaves business owners with a decidedly unglamorous responsibility. Somebody needs to know what technology the website actually runs on, who maintains it, and whether the underlying PHP installation has received the security updates—not merely the latest theme or plugin refresh.

Ask the people responsible for your site what version of PHP it uses and whether the affected environment has been patched or otherwise protected. Get an answer you can understand. If the answer sounds suspiciously like “probably,” keep asking.

The internet's plumbing hasn't changed.

The plumbers did.

And now would be a lovely time to check under the sink.

#Cybersecurity #ArtificialIntelligence