Severe vulnerability in PHP causes millions of attacks and could affect up to 70% of all websites on the internet in the world

PHP patch 8.5.12 was released following the discovery of a serious flaw in the programming language.
Artificial intelligence assisted in identifying these vulnerabilities.
Cloudflare reported millions of exploitation attempts spiked within hours of a public announcement.
The FBI warned that actors could execute code remotely in PHP, compromising data and networks.
In the UK, Prime Minister's office services had limited disruptions while security work occurred.
James Sullivan noted two critical flaws: one corrupts memory allowing code exploitation; the other risks non-deleted user data exposure.
OpenAI reported leading a coalition to address the issues over two months, noting AI detected them prior to attackers.
Japan advised administrators using PHP to immediately install patches or consider temporary suspensions.
The European Union Agency for Cybersecurity (ENISA) urged organizations to take immediate action.

The narrative centers on a crisis point where advanced computational discovery—AI finding long-dormant flaws—intersects with legacy digital infrastructure, creating systemic fragility. The primary tension lies between the demonstrated capability of cutting-edge AI for security discovery and the protracted slowness of widespread enterprise patching cycles across critical global services. It is crucial to differentiate the capabilities described: the vulnerabilities allow remote control or data leakage, which necessitates disconnection (a pragmatic risk management measure), not merely a failure of design theory. The implication here suggests that the complexity of modern software ecosystems means vulnerability remediation often involves making temporary operational sacrifices—accepting service limitation as a necessary toll for maintaining systemic integrity. This pattern reveals a potential lag between technological breakthroughs in defense (AI detection) and their universal integration into operational security practices, highlighting an inherent architectural asymmetry in global digital resilience.
What assumptions underpin the claim that widespread patching is feasible across all 70% of affected sites? If organizations are hesitant to update due to testing concerns or resource scarcity, what structural incentives should govern this patch deployment timeline to prioritize national and citizen safety over operational uptime? How does the reliance on external AI entities (like OpenAI) for critical national infrastructure assessment shift responsibility between developers, end-users, and security researchers?
Patterns detected: none