HOW DRU CATCH SEES IT

The Backbone of the Internet Needed a Chiropractor

PHP has been running quietly under the internet's floorboards since 1994 - older than Google, older than most of the developers patching it, and about as glamorous as the load-bearing wall you only notice when it cracks. The language powers an enormous share of the web and apparently nobody had given it a proper structural inspection until an AI showed up, stethoscope in hand, and pointed at the spine.

The PHP Foundation and the FBI's cyber division issued simultaneous advisories on October 22, 2026, warning of two critical vulnerabilities described by experts as among the most notable in recent memory. The recommended response: patch immediately, or shut your site down. That is the full menu.

Patch or Unplug: A Bold Strategy From the People in Charge

The official guidance - patch it or turn your website off - accurately describes the options while spectacularly underselling the problem. Governments, corporations, and organizations were sent into a reactive scramble, per the source. The advisories were thorough enough to trigger a 'flurry.' They were not, apparently, thorough enough to include a third option for the vast majority of operators who cannot do either quickly.

This is institutional alarm at its most theatrical. The PHP Foundation, whose stated mission includes transparency and accountability for the language, co-signed a bulletin with the FBI that essentially told the operators of a large share of the internet's websites: good luck with that. The press conference happened. The advisories went out. The patch window opened. How many sites can realistically close or update on emergency notice is a question the advisories do not address.

The AI Found the Hole in the House It Also Lives In

The detail that sharpens this whole episode is buried in the framing: AI tooling detected these vulnerabilities. The same technology simultaneously celebrated as civilization's next chapter and feared as an existential threat is now the primary auditor of the infrastructure the modern internet - including enormous amounts of AI-serving infrastructure - runs on. PHP backends power swaths of the web that AI systems depend on. The AI found the cracks in its own foundation.

That is not an argument against using AI for security detection. It probably caught something important. It is an argument about the recursive absurdity of the situation: we spent years not thoroughly auditing a language that powers the majority of websites, and the thing that finally noticed was the technology we also have not thoroughly audited. Nobody appears to find this loop especially uncomfortable. The FBI issued a press release. Everyone scrambled. The backbone creaked.