PHP Vulnerability, Simply Explained（原声文稿）

One of the biggest hacker forums on the internet switched itself off, a place where criminals buy and sell stolen data. Its message was short. We're going offline until PHP is fixed.

The hackers were afraid of getting hacked. And they were not alone.

Governments switched off their websites. Big banks in Japan paused online services.

America's government told Update Now or Unplug. All because of one tiny hole.

It had been hiding for 14 years, in software used by most of the websites you visit.

Then, in just a few weeks, AI helped three different teams find it. So how did something that big stay hidden for so long?

And why had the people meant to fix it already seen it coming?

Every time you open a website, a computer somewhere builds the page for you.

On most of the web, the program doing that job is called PHP. You've never seen it.

But it runs WordPress, Wikipedia, online shops, government sites. About 7 in 10 websites by one popular count.

Here's the easiest way to picture it. Every website is a hotel.

PHP is the staff working inside. When you visit, you're a guest. You check in, ask for something, get it, and leave.

Then the staff tidy the room for the next guest. Over and over. Millions of times a second.

And that's exactly where the hole was hiding. Hotel staff have a safety rule.

If a guest asks for something far too big, they stop. Drop everything. Next guest. PHP has the same rule.

It's called the memory limit. Every visit gets a fixed amount of working space.

Use too much, and PHP stops the job on the spot. It's there to protect the server.

But imagine a guest who knows the rule.

They send a request that looks normal, but it's designed to make PHP do a mountain of tiny jobs, just enough to hit the limit at exactly the wrong moment.

Like asking the cleaner to fold 10,000 tiny towels timed so they collapse halfway through making the bed. The room is half done. But the hotel marks it as ready. Anyway.

Now the trick. Before the cleaner collapses, the guest slips a package into the drawer.

The staff never go home between guests. The same worker moves straight on.

A new guest checks in. Maybe the same person under another name.

And the staff, following their routine, open the package. And do whatever the note inside says.

With the staff's own master keys. That's the hole.

PHP can leave leftovers from one visit, and a later visit can use them.

In the right conditions, a stranger can take control of the server. No password needed. And here's what makes it scary. This happens at the front desk.

Before the website even knows anyone has arrived. Websites have their own security.

Passwords, login checks, guards. But they're all standing inside the hotel.

The package gets handed over in the lobby. So it doesn't matter how well a website was built.

If it runs on an affected version of PHP, the hole comes with it.

The oldest version with this hole came out in 2012. 14 years. Millions of websites. Plenty of expert eyes. Why did nobody catch it?

Because it hides in the one moment nobody looks at. The split second when PHP gives up.

And even if you suspect it's there, turning it into an attack is slow, fiddly work.

Try, fail, adjust, try again. For weeks. That slow, boring work was a kind of protection.

In 2026, AI made it fast. Summer, 2026.

OpenAI starts a program to help fix the free software the whole internet runs on. Researchers working with AI.

One of them is Ryan Austin from a small California security firm called Calif. He picks PHP.

He knows its history and where it has broken before. Think of looking for a lost ring on a huge beach.

For years, people searched with their hands. AI is a metal detector. Within days, Ryan finds the first weak spot.

Then he asks the AI to turn it into a recipe. A pattern to look for somewhere else.

The recipe finds a second hole. By mid-August, he shows PHP's team a working attack. They test it. It works.

Here's the strange part. On the same day Ryan reports it, OpenAI reports the same problem.

Found separately. Two weeks later, a third team finds it too.

Wiz, a security company owned by Google. Also using AI. 14 years of silence. Then three teams in a few weeks.

The AI didn't do it alone. Ryan himself says, no AI finds every bug, just because you ask.

The expert still has to know where to dig. But a metal detector works for anyone who picks it up.

If the good guys could find this with AI, who else could? And then the biggest surprise.

When the reports arrive, the PHP team recognizes the problem.

Two years earlier, in 2024, one of their developers had noticed the first signs. Back in the hotel. The cleaners sometimes collapse mid-room.

But nobody could prove a guest could use it. And every fix had a cost.

One would break older websites. One could crash servers.

One would force thousands of other programmers to change their code.

Imagine changing how every cleaner in every hotel in the world does their job without closing a single hotel. The team made decisions by agreement. Everyone had to say yes.

They didn't. So the fix waited for months.

And PHP is looked after by a small team paid largely by donations. Afterwards, the people who run PHP admitted it.

The delay, they said, was a structural failure. By October, the fix is ready. Now comes the delicate part.

Releasing a fix like this is like planning a surprise party.

Everything happens in secret.

The big hosting companies get the fix a little early, quietly. Then, at one agreed moment, it goes public. And everyone updates at once.

Before attackers know what to look for. The date is set. Thursday, October 22nd.

The party never got its surprise. Amazon runs fake servers all over the internet.

Think of a decoy house full of cameras built to catch burglars.

On Saturday, October 17th, one of those decoys catches someone trying the PHP hole four days before anyone was supposed to know it existed. How did they know? Amazon says it isn't clear. Maybe a leak.

Maybe someone found it on their own. Maybe with AI, like everyone else. We still don't know.

Then the secret falls apart. On Tuesday, word of the hole spreads online.

PHP moves the release a day earlier. That evening, one of the teams that found the hole posts a video of the attack.

By mistake. It's deleted, but copies spread.

By Wednesday morning, attack code is going around, and a company publishes the fixed software hours early so anyone can compare old and new and spot what changed.

It's a surprise party where someone posted the invitation, the address, and the time on social media. Wednesday afternoon, October 21st.

PHP publishes the fix. Its message is simple. There's no shortcut. Update.

It's the only safe choice. And the many websites running versions too old to get updates? They're on their own.

Cloudflare, a company that protects a big part of the web, kept count.

Before the announcement, thousands of attack attempts. 45 minutes after, tens of thousands.

Two hours after, hundreds of thousands. That night, millions.

And the attackers kept changing their tricks, learning from what got blocked. So people did something unusual. They pulled the plug.

Finland switched off its government websites.

The Netherlands, France, Germany, Belgium, and the Czech Republic took sites down too. In Japan, big banks paused online services.

An airline switched off boarding passes on phones. Parts of the BBC went dark.

So did systems behind Wikipedia.

America's government told companies, if you can't update, unplug. And the hacker forums went dark too.

Even the burglars locked their own doors. So, millions of attempts. How many actually got in?

As of October 22nd, when this was written, no confirmed break-ins.

Not one confirmed by any government agency. Amazon says attackers are trying it everywhere.

But trying the door is not the same as getting in.

Germany's cyber security agency saw the attacks, and none that worked. Its deputy chief said the whole seems a little bit more complicated than expected to exploit.

Remember the hotel. To leave the package in the right drawer, the attacker has to know the room.

Which version? Which setup? Which kind of server?

Some famous attacks of the past worked like a master key. One trick every door.

This one is more like a lock you have to study first. That's the good news. The warning, it could change fast.

And a burglar who got in quietly may not be noticed for weeks. So, was this the end of the internet? No.

But it showed us something. A hole sat hidden for 14 years.

Someone saw the first signs, and the fix waited. Then AI helped three teams find it in a few weeks.

And someone else may have found it too. AI didn't create the hole. It was always there.

AI just handed out metal detectors to everyone. Finding holes is getting fast and cheap. Fixing them still takes people.

A few experienced people, careful not to break millions of websites.

In October, the hacker forums switched off and waited for someone to fix the internet. So did the rest of us.

The question isn't whether AI will find the next hole like this. It's whether the people fixing it can keep up.