An AI-Discovered PHP Vulnerability—The Real Danger Is Websites No One Is Looking After

Recently, I saw news that a serious vulnerability had been found in PHP, the programming language that powers many websites, prompting emergency responses in many places.

The online English lesson service I use also happened to be down for maintenance. I do not know whether it was related to this issue, but the timing was remarkable.

What I found particularly interesting was that the vulnerability had been discovered through research using OpenAI’s AI.

AI found a flaw in a program that had been overlooked for years.

It seems that era has finally arrived.

Are the Websites I Built Years Ago All Right?

I also used to develop many websites with PHP.

When I saw the news, I suddenly remembered some of my old projects.

“I wonder what has happened to that website by now?”

Of course, the contract ended long ago. I am no longer in a position to handle it, and I do not know what condition it is currently in.

But that made me think about the countless websites belonging to small and medium-sized businesses and individuals.

Many of these sites are designed so that employees without specialized knowledge can update articles and company news.

But being able to update content and being able to maintain a system securely are entirely different things.

The Company That Built It No Longer Exists

Imagine a small business that hired a web development company to build its website ten years ago.

It paid a reasonable amount at the time, and a respectable website was completed.

Since then, an employee has occasionally updated the news section, and the site has continued running without any particular problems.

But what happens when a vulnerability like this one is discovered?

First, no one knows whom to contact.

The web development company may already have gone out of business. The person responsible may have left the company. Perhaps there was never a maintenance contract in the first place.

Even if the business is lucky enough to find a company willing to help, the next problem is cost.

Updating an old system can break features that had worked until then. In some cases, the website may even need to be substantially rebuilt.

From the website manager’s perspective, something that worked normally until yesterday has suddenly generated a demand for a significant payment.

And paying that money will not add any new features or increase sales.

It is simply the cost of safely maintaining the same thing that existed yesterday.

For a business owner, that must be a very difficult expense to accept.

Advances in AI Make Old Websites More Dangerous

What is truly frightening about this news is that AI will continue to improve at discovering vulnerabilities.

Flaws that previously went undetected will be found one after another.

That is welcome progress for defenders, but attackers can use AI too.

If the search for weaknesses in old websites also becomes more efficient, sites that have been neglected for years will become increasingly dangerous.

And the difficult part is that the speed at which AI advances and the speed at which small businesses update their old websites are completely out of balance.

While the latest technology keeps discovering new problems, a site’s administrator may still be asking, “Who built this thing in the first place?”

There is no contest.

It May Be Time to Rethink “Owning” a Website

Seen this way, perhaps it is time to reconsider whether small businesses should operate their own website systems at all.

Today, there are countless web services whose systems are managed by specialized providers.

Shopify is a typical example for online stores, while Wix is one for general business websites.

With services like these, updates to the underlying system and security measures are generally handled by the service provider.

Of course, they charge fees, and they are not immune to outages.

But I think they are a far more practical choice than continuing to keep an old system in-house when no one is available to maintain it.

What an ordinary small business wants, after all, is a website that runs safely—not the right to manage a web system itself.

You Build It Once, but Maintain It Forever

People often assume that website development is finished once the initial production cost has been paid.

In reality, maintenance begins the moment the website is completed.

Technology changes, old systems stop working, and new vulnerabilities are discovered.

From now on, AI will accelerate those changes even further.

That is why the news about PHP reminded me of the websites I built years ago.

Years of trouble-free operation do not necessarily mean a system is safe.

AI has become capable of finding flaws hidden in code written ten years ago.

Unfortunately, it still cannot tell us where the person who wrote that code ten years ago is now.