For twenty years, seven out of every ten pages on the Internet rested on a crack that nobody saw. An artificial intelligence found it, not a person, and it sat inside PHP, an almost invisible programming language that runs everything from Wikipedia to the website of any city hall. The scare was so great that the most powerful spy agency in the world asked everyone to close it immediately or shut down their machines.
This leaves us with an unavoidable question:
How could we live for two decades on top of such a large flaw without anyone noticing, and what does it say about us that a machine was the one to find it?
The Invisible Bricklayer Who Built Half the Internet
By: Gabriel E. Levy B.
Every time we open a web page, something happens that we never see. Somewhere in the world, a computer receives our request, assembles the page and sends it to us. Those computers are called servers, and the language many of them work in is called PHP.
PHP was born in the mid-1990s as a simple, almost handmade tool so that anyone could build pages that changed over time. Over the years it became the silent bricklayer of the web.
According to the measurement firm W3Techs, close to 70 percent of the sites on the Internet run on it. That includes WordPress, the system behind most of the world’s blogs and small news outlets, and also Wikipedia.
And for two decades, that bricklayer built on top of a crack.
The flaws now known as PHP2Shell are present in every version of the language since 2012, and according to TechCrunch the problematic code dates back to 2004. Almost everything we have read or bought on the Internet in twenty years passed right over it.
What a Machine Saw and Nobody Had Seen
You do not need to be an engineer to understand the flaw. Picture a receptionist who greets visitors at an office: every time someone leaves, she should clear the desk and put away their papers before receiving the next person.
Under certain conditions, when a visit ends badly because the computer runs out of memory, PHP does not clear the desk properly. Papers from the previous visitor remain, and a patient attacker, posing as the next visitor, can read them, find passwords and keys, and in the worst case sit down in the receptionist’s chair and run the whole office.
That is what researchers at the firm Calif managed to demonstrate in August, working with models from OpenAI, the company behind ChatGPT, and a few days later the team at Wiz, a security company owned by Google, with help from Gemini and those same models.
The crack was not hidden. It was just too high up to reach.
In 2024, a team at the firm Quarkslab had already stumbled on the same error and let it go, because exploiting it looked so hard that it was not worth worrying about.
Wiz tells it with striking candor: turning that error into a real attack required chaining several failures and adapting to each machine, a job that would have taken a team of experts months, and that a single person helped by artificial intelligence completed in one week.
Personally, I believe that is the news that truly matters. The machine did not invent the crack. What it brought was the endless patience that we humans lack to look at what has been in plain sight for twenty years.
The Day the Spies Asked Everyone to Turn Off the Lights
On October 21, the same day the foundation that looks after PHP published the fix, the National Security Agency of the United States, the NSA, the same one from the spying scandals, posted a warning so unusual that many people thought it was fake.
It asked every organization in the world that used PHP to install the fix immediately, and added a sentence that almost never comes out of an intelligence agency: if you cannot fix it right now, shut your systems down until you can.
In the trade, that fix is called a patch, like the one sewn onto a torn pair of pants, and in this case it had to be applied to tens of millions of machines at the same time.
And the world obeyed.
According to Al Jazeera and Reuters, the governments of Belgium, the Netherlands, Finland and the Czech Republic took public portals offline for hours in order to patch them. Some citizens could not complete a procedure or read an official notice that Wednesday, and nobody explained why.
The rush made sense. Someone leaked the instructions for exploiting the flaw ahead of time, the fix had to be moved up by a day, and according to the Resilient Cyber newsletter, in less than two days there were millions of attack attempts against machines that had not yet been updated.
The Suspicion of a Back Door
As usually happens when a spy agency suddenly shows up asking everyone to close a window, a darker reading emerged in forums and on social media.
According to that version, the crack was never an accident: it was a back door, that is, a secret entrance left on purpose by some security agency, perhaps the NSA itself, to get into any site in the world whenever it wished, and once an artificial intelligence found it, the agency would have preferred to feign surprise and join the good guys.
The distrust does not come out of nowhere. In 2013, the documents leaked by Edward Snowden showed that the NSA had deliberately weakened an encryption system, the mathematical lock that protects communications, and that memory still weighs heavily.
The facts, however, tell a different story.
As an analysis on Hackernoon points out, there is not a single piece of evidence that anyone planted this flaw, and the behavior of everyone involved points the other way: several private companies do not usually discover a secret entrance at the same time, much less does the one who planted it announce it to the world.
We will probably never know for certain whether anyone knew about the crack before the machines did, because in the world of espionage what is known is not said, and what is denied cannot be proven. What we can say is that the simplest explanation, a human error from twenty years ago that nobody had time to look at, accounts for everything that happened without the need for a villain.
What It Means for Us
In Latin America this matter is less distant than it seems. A huge share of the websites of city halls, universities, small media outlets and family businesses is built on WordPress, hosted on shared computers and running versions of the language that stopped receiving care years ago.
For a large company, patching the crack was a matter of hours. For a municipality that pays for cheap hosting and has nobody to read alerts in English, the crack is still open and will stay open until somebody remembers it.
Patience is no longer a human advantage.
The foundation that looks after PHP acknowledges that since July, artificial intelligence has helped it find fifteen new flaws, and OpenAI already speaks of a defender’s window: the brief time that passes between the moment a machine discovers an error and the moment other machines exploit it.
Finally, I think there is a humbling lesson in all of this. For twenty years we trusted that if something this serious existed, someone would have seen it. Nobody did, because looking patiently at what is old and boring is exactly what humans do worst and what machines do best. From now on, the only real defense is to stop assuming that silence means safety.
In short, an artificial intelligence found in PHP, the invisible language that holds up seven out of ten pages on the Internet, a crack that had been open for twenty years, and the scare was such that the NSA asked the world to patch it or shut down its machines. The theory of a spy agency’s back door has no evidence behind it, but the lesson remains: for two decades we slept on a flaw nobody looked at, and in our region many are still sleeping on it.
References
- Tzadik, S., Tamari, S., Ohfeld, N. & Schwartz, T. (2026, October 21). PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet. Wiz Blog. https://www.wiz.io/blog/php2shell-php-rce
- Bort, J. (2026, October 21). PHP Armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet. TechCrunch. https://techcrunch.com/2026/10/21/php-armageddon-openai-googles-wiz-find-ancient-holes-panicking-the-internet/
- Farooq, U. & Reuters. (2026, October 22). World leaders warn of security flaws found in PHP programming language. Al Jazeera. https://www.aljazeera.com/news/2026/10/22/world-leaders-warn-against-security-flaw-found-in-php-computer-programming
- The Hill. (2026, October 22). NSA warns organizations to patch security flaws identified by AI. https://thehill.com/policy/technology/6163568-nsa-warns-php-security-flaws/
- CNBC. (2026, October 22). Why governments pulled websites offline over the decades-old PHP programming language. https://www.cnbc.com/2026/10/22/php2shell-vulnerability-what-is-it-and-is-your-data-at-risk.html
- The Hacker News. (2026, October 25). Someone tried to exploit PHP2Shell 4 days before the vulnerabilities were publicly disclosed. https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html
- Hackernoon. (2026, October 22). NSA says patch PHP or go offline as AI-found PHP2Shell flaws reach ~70% of the web. https://hackernoon.com/nsa-says-patch-or-go-offline-as-ai-found-php2shell-flaws-reach-70percent-of-the-web
- Resilient Cyber. (2026, October 23). The Resilient Brief: PHP2Shell goes from leak to millions of attempts in under two days. https://www.resilientcyber.io/p/the-resilient-brief-php2shell-goes-from-leak-to-millions
- The PHP Foundation. (2026, October 21). Today’s PHP security release and how we’re strengthening PHP security. https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
- OpenAI. (2026, October 21). Coordinated disclosure of critical vulnerabilities. https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/
