# AI Is Combing the Web's Old Code. People Still Patch It.

*AI tools are finding years-old flaws in the software under everyday services faster than ever. This past week showed who does the fixing, and who waits while they do.*

By Jay Cadmus | Published October 25, 2026
Canonical: https://theainextwave.com/editions/2026-10-25/

## The Short Version

At 9:25 on Sunday morning in Japan, phones on SoftBank's network started receiving earthquake and tsunami warnings again. They had gone quiet at 6:47 a.m. on Friday, when the carrier switched off its emergency alert mail to fix a flaw in PHP. That's the software behind about seven in ten websites whose programming language can be identified. Evacuation notices from national and local governments are still off, and SoftBank expects to finish the work on Monday. Until then it's pointing customers to a separate disaster app.

That flaw was found with help from AI, and more like it are coming. Cloudflare's chief executive told Reuters this week that he knows of other severe flaws in critical software. Google's threat researchers counted roughly twice as many flaws reported in August as in January.

So this Sunday edition steps back from the news. When machines get good at finding holes in old code, someone still has to close each one, and someone else waits while they do. The next five years will turn on how well we plan for both.

## How a Machine Found an Old Bug

The PHP Foundation, which pays a handful of the people who maintain PHP, laid out the story on October 21, the day the fixes shipped. Earlier this year Anthropic's Claude Mythos model scanned PHP's code through a security program called Alpha-Omega. On August 11 a researcher at the security firm Calif reported a way to take over a web server without logging in. Wiz and OpenAI followed with more ways in. A PHP developer had first seen signs of the underlying problem during an outside audit in 2024, but nobody then found a way to turn it into an attack.

The people side of that account matters as much as the machines. The Foundation says security work rests on "a small group of foundation-funded developers and a little volunteer help." Since July 1 the team has published 15 security fixes and sorted through more than 100 reports that turned out to be wrong, duplicates, or impossible to reproduce. AI tools help it check and group those reports, the Foundation says, "but a person makes every call and works on every patch."

That's the shape of what's changing. A model can surface many candidate flaws quickly, and each real one lands on the same few desks. The Foundation has responded by hiring, including an AI security engineer in residence, and by changing how its security team makes decisions so stalled fixes move faster.

## Who Waited During Patch Week

The fixes forced a choice on everyone running PHP. Reuters reported that outages began on Wednesday at government sites in Europe and elsewhere, as operators took sites offline until they could patch. That's the advice the European Union's own cybersecurity team gives when a fix can't go in right away: isolate internet-facing systems "from public networks until the fix is applied and verified."

The scale of exposure is large and fuzzy. The security service VirusTotal counted about 920,000 machines in the United States that looked like PHP servers reachable from the internet. Worldwide, it found about 758,000 running PHP versions that no longer get security fixes. The company stresses that these numbers describe PHP's footprint, and they don't tell anyone which machines are actually vulnerable.

Attackers moved quickly, though the damage so far is hard to measure. Amazon's researchers saw attempts four days before the flaws were announced, SecurityAffairs reported, adding that detected attempts don't automatically mean successful break-ins. One threat-tracking firm told Reuters that, as of Thursday afternoon, the criminals it watched appeared to have failed to build a working attack tool. Cloudflare's chief executive said he had seen anecdotal evidence of break-ins. I haven't found a published count of harm prevented or harm done, and I'd treat claims either way with care until one appears.

## Picture a Volunteer Webmaster

Picture Maria, a parent who runs the website for her town's youth soccer league in her spare time. It's a WordPress site, one of about 538,000 that VirusTotal counted among PHP machines online, and fall sign-ups are open. Her hosting company emails that a critical PHP fix is coming. She can trust the host to patch in time, or take the sign-up page down until it does. Either way, families need another way to reach the league for a few days.

What has to be in place first is plain. Maria needs to know who hosts the site, which PHP version it runs, and who on the league board can approve taking it offline. Then she can run a small test before the next patch week. She asks the host, in writing, how many hours it took to apply this fix, which gives her a baseline. She sets up a backup: a text or email list of registered families, plus a one-page notice the host can show while the site is down. Then she walks the board through it once.

She counts what actually matters to families: how many heard about an outage the same day, and how many sign-ups had to be redone. The extra work is a few hours a season, and it lands on a volunteer. It can fail if the host is slow to answer or the family list is out of date. The board president holds the authority to pull the site, and the host decides when it comes back.

## Two Earlier Patch Weeks

We've lived through this pattern before, and both times taught a lesson that still applies. In April 2014, a bug called Heartbleed in OpenSSL, a piece of code that protects web traffic, left many websites open to data theft. The cause was a simple coding error that went unnoticed for three years. At the time, OpenSSL had basically two developers and got about $2,000 a year in donations, Linux.com later reported.

Money followed the crisis. The Linux Foundation pulled about a dozen companies into a fund for underfunded critical projects, and by December 2014 OpenSSL had 15 team members, two of them paid full-time by that fund. Tim Hudson of OpenSSL called it "a wake up to the industry" and to the companies that had been getting a free ride.

Log4j taught the second lesson, about how long a fix takes to reach everyone. In July 2022, a new federal Cyber Safety Review Board looked back at that flaw in a widely used logging tool and called it an "endemic vulnerability." Unpatched copies, the board said, would remain in systems for the next decade, if not longer. Its deputy chair described open-source developers as thinly resourced and largely volunteer.

AI changes the speed of the first step. Heartbleed sat hidden for three years. The next ones may sit for months, or weeks, because machines are now reading the old code too.

## The Next Five Years

The numbers so far point in two directions. Google's threat intelligence group counted monthly vulnerability disclosures rising from about 5,000 in January to about 10,700 in August, CSO Online reported. Yet only about one disclosed flaw in 431 gets exploited. Researchers at VulnCheck found that AI-discovered flaws were exploited at roughly the same low rate as everything else in the first half of the year.

Speed is moving, though. VulnCheck's median time from a flaw's public listing to confirmed attacks fell from 120 days in 2025 to 80 days in the first half of 2026. Reuters reported that working attacks which once took an expert weeks or months can now be produced with AI in hours.

The experts Reuters interviewed split on what that means. Daniel Stenberg, who leads the widely used curl project, argued that AI tends to find exotic bugs that criminals struggle to use. Cloudflare's Matthew Prince expects a rough stretch: "I think we're going to have a couple years where every single week it's going to feel like the sky is falling." He also compared it to clearing monsters out of a haunted house, unsettling now and better than leaving them hidden.

My read is that both are right, on different clocks. Over five to ten years, AI should leave the old code under public life cleaner than it found it, much as Heartbleed left OpenSSL better funded. In the meantime, patch weeks will come more often. The cost will fall on the people who keep a council site, a clinic portal or a league page running, and on everyone who needs those services on a bad day.

## Opportunity Radar

Small organizations run on websites nobody owns full-time: leagues, churches, food pantries, family clinics. When a patch week hits, they need three things written down: who hosts the site, what software it runs, and a backup way to reach their people. A local IT pro or web designer could offer a "patch-week kit" for a flat fee: a one-page inventory, a static notice page the host can switch on, and a contact list set up for text or email. Test it cheaply by offering it to ten local groups you already know and seeing whether three will pay. Demand is a hypothesis until they do. Walk away if hosting companies start bundling the same thing for free, which some may after this month.

## What You Can Do With This

### If you rely on phone alerts or online public services

Set up a second route for emergency warnings, such as your county's alert sign-up or a weather app with alerts turned on. When a city or tax site goes dark during a patch week, check its social accounts or call before assuming something worse happened.

### If you run a website for a club, church or league

Write down who hosts the site, which PHP version it runs, and who can approve taking it offline. Ask your host how fast it applied last week's fix, and keep a simple text or email list so families hear from you when the site can't.

### If you run a small business, clinic or office

Ask your web provider, in writing, whether PHP was updated and whether your logs show anything odd going back to October 17. If a site can't be patched quickly, the European Union's cybersecurity team advises taking it off the public internet until the fix is in and checked.

### If you work in local government IT

Add "patch week" to your continuity plan next to storms and power cuts, with a named person who can pull a public service and a plain message ready for residents. The flaws are going to keep coming, so write that message before you need it.

## The Bigger Picture

Each big patch week of the last decade fixed something beyond the bug itself. Heartbleed got money flowing to code everyone used and almost nobody paid for. Log4j showed that a fix takes years to reach every corner. This one shows AI speeding up discovery, while the fixing still runs on a small group of people and the waiting falls on everyone else. My read is that the places that come through the next few years best will treat patch days like weather: expected, planned for, with a backup for the people who can least afford a service going quiet. A Japanese phone that got its quake warnings back on Sunday is a small reminder of who that backup is for.

## References

[SoftBank: Notice on suspension of emergency alert mail for PHP vulnerability maintenance, updated with partial restoration (Oct. 25, 2026)](https://www.softbank.jp/corp/news/info/2026/20261023_01/)
[The PHP Foundation: Today's PHP security release and how we're strengthening PHP security (Oct. 21, 2026)](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/)
[W3Techs: Usage statistics of PHP for websites (accessed Oct. 25, 2026)](https://w3techs.com/technologies/details/pl-php)
[Reuters via The Star: AI-discovered bugs may soon trigger fresh disruptions, cyber experts say (Oct. 23, 2026)](https://www.thestar.com.my/tech/tech-news/2026/10/23/ai-discovered-bugs-may-soon-trigger-fresh-disruptions-cyber-experts-say)
[CERT-EU: Security Advisory 2026-018, Critical Vulnerabilities in PHP (v1.2, Oct. 23, 2026)](https://cert.europa.eu/publications/security-advisories/2026-018)
[VirusTotal: Sizing the PHP exposure window (Oct. 21, 2026)](https://blog.virustotal.com/2026/10/sizing-php-exposure-window-for-cve-2026.html)
[SecurityAffairs: Pierluigi Paganini answers questions about the PHP2Shell flaws (Oct. 24, 2026)](https://securityaffairs.com/201662/hacking/pierluigi-paganini-answers-questions-about-the-php2shell-flaws.html)
[Linux.com: OpenSSL after Heartbleed (Dec. 20, 2016)](https://www.linux.com/topic/networking/openssl-after-heartbleed/)
[The Record: First Cyber Safety Review Board report finds Log4j has become an "endemic vulnerability" (July 14, 2022)](https://therecord.media/first-cyber-safety-review-board-report-finds-log4j-has-become-an-endemic-vulnerability/)
[CSO Online: AI accelerates n-day attacks, as flaw disclosures and exploits double (Oct. 6, 2026)](https://www.csoonline.com/article/4230247/ai-accelerates-n-day-attacks-as-flaw-disclosures-and-exploits-double.html)
[Infosecurity Magazine: Just 1% of AI-discovered vulnerabilities exploited in the wild, research shows (July 29, 2026)](https://www.infosecurity-magazine.com/news/one-percent-ai-vulnerabilities/)