Skip to content

AI & Automation1 min read

Security flaws discovered in PHP programming language

Two vulnerabilities in PHP could allow unauthorised server access, according to a report by dylan.page on TikTok.

by Fini MironFounder @ Balkaris
An abstract composition printed flat in deep charcoal, bone white, warm mid grey and bright electric lime green: four large rectangles lying flat and overlapping like sheets of paper on a table, each offset slightly to the right of the one beneath it.
Drawn for this article on our own machine. It is not a photograph.

According to dylan.page on TikTok, two major security flaws were discovered in the PHP programming language yesterday. The creator reports that these vulnerabilities could allow hackers to control servers and access customer data without a password. This issue reportedly affects approximately 70% of all websites, including those used by Facebook and several European governments. The source claims that AI was used to identify one flaw that had existed for over 14 years.

The video this was written from, by @dylan.page. See it on TikTok.

Why it matters

Relying on widely used legacy languages creates a single point of failure for your digital infrastructure. If your web stack includes PHP, you cannot assume your systems are secure simply because they have functioned without issue for years. The discovery of a fourteen-year-old flaw proves that stability is not the same as security. You must move from reactive patching to a proactive audit of your software supply chain.

  • Verify that your hosting provider applies security patches to the server environment immediately.
  • Audit third-party plugins that may introduce additional vulnerabilities.
  • Assess whether your data sensitivity justifies moving to more modern or isolated environments.

What to watch

You should immediately audit your server environments to confirm which versions of PHP are currently active. Check if your hosting provider or internal teams have applied the latest security patches. Relying on automated tools to find bugs is a double-edged sword. If AI can find hidden vulnerabilities in legacy code, hackers can use those same tools to exploit your specific architecture.

Resilient teams do not wait for quarterly reviews. They integrate automated scanning of legacy codebases into their weekly deployment cycles to catch these patterns early.

Key takeaways

  • Stability in legacy code does not guarantee security.
  • AI tools can identify vulnerabilities that have existed for over a decade.
  • Businesses must audit their software supply chains and third-party plugins.

Frequently asked

How can we determine if our specific website is at risk?

You must check which version of PHP your server is running and confirm that your hosting provider has applied the latest patches.

Is it safer to move away from PHP entirely?

It depends on your data sensitivity and the complexity of your current architecture, but moving to more modern or isolated environments may reduce your risk profile.