AI found 22-year-old holes in 70% of the internet. AI also made them dangerous enough to matter.

The U.S. National Security Agency issued an alert on Wednesday about two critical vulnerabilities in PHP, the programming language quietly running roughly 70% of all websites. Patches exist. The problem is applying them across tens of millions of sites before someone starts exploiting the ones that haven't.

The holes have been sitting in PHP since version 5, released in 2004. They were hiding in plain sight across more than two decades of web infrastructure, and nobody found them, because until recently, nobody had a tool sharp enough to look properly.

OpenAI's Patch the Planet initiative and Google's Wiz security team both used AI models to surface the flaws, which is the good news. The uncomfortable part sits directly underneath it: the same capability that found the vulnerabilities is what makes them newly exploitable. Before AI, adapting a PHP exploit across different versions, configurations, and memory layouts was genuinely hard. Now it isn't. Wiz put this plainly in its disclosure.

So the scoreboard reads: AI found it, AI fixed it, AI also turned it from an academic curiosity into a practical weapon. The patches are ready. The clock, less so.