AI is finding old website bugs faster, so updates can't wait
Two serious flaws in PHP, which powers a huge share of the web, show why keeping your website and plugins patched matters more than it used to.
What happened
TechCrunch reports that last week, two critical bugs turned up in PHP, the open source programming language behind roughly 70% of websites. Some organizations scrambled to fix their systems, and some took sites offline until the bugs were patched. (A "patch" is just a software fix.)
According to TechCrunch, Tomer Schwartz, CTO of Exposure Management & AppSec at Google-owned Wiz, was part of the scramble to fix the bugs, alongside OpenAI, the research group Calif and the PHP team.
The episode description on TechCrunch's podcast page says the show covers why Schwartz believes Wiz couldn't have found these bugs without AI, and how custom tooling tested dozens of ideas over a weekend. It also covers how one bug sat in plain sight for more than a decade.
Why it matters
TechCrunch reports that the researchers who found the bugs say this is only the beginning, because AI changes how quickly novel vulnerabilities can be uncovered and exploited.
The same pattern shows up elsewhere. Shane O'Donnell of Centric Consulting writes in Forbes that Microsoft patched 974 vulnerabilities in one record-breaking update, and that researchers point to AI-assisted discovery as the driver. He cites Cloud Security Alliance research saying AI tools can now write working exploit code for a newly disclosed flaw in 10 to 15 minutes for about a dollar.
O'Donnell also writes that exploitation has gotten faster, and that the window between a flaw being disclosed and being used keeps closing. For you, the takeaway is simple: a site that is down or hacked costs you bookings, sales and customer trust.
What it means for your business
- Restaurants and retail shops: If your menu, online ordering or shop lives on your website, ask whoever built it whether it runs on PHP, since so many sites do. An outage on a busy weekend is lost orders, so updates are part of keeping the doors open.
- Clinics and law firms: Your site may collect appointment requests or contact forms with private details. Keeping its software current is a sensible precaution for any site that handles information like that.
- Trades and home services: Your website is often your main source of leads. If it goes dark or shows spam, customers will call the next company on the list.
- Anyone with a web designer or host: Ask who is responsible for updates. "Nobody, I think" is a common and risky answer.
One thing to try this week
Spend 15 minutes making a list of what runs your website: the platform, the plugins, the theme and the company that hosts it. Then log in (or email your web person) and check for pending updates.
Install what's waiting, after making a backup if your host offers one. Turn on automatic updates wherever the option exists, and write down who is responsible for checking monthly.
One more tip comes from Forbes, where O'Donnell writes that age is what gets exploited and suggests sorting open vulnerabilities by age instead of severity. He's writing for larger companies, but the idea works for you too: start with the update that has been waiting the longest.