AI Finds Two Holes That Sat in Web Software for About Twenty Years

PHP is the software behind roughly 70% of websites, including most sites built with WordPress. On 21 October, its developers released fixes for two critical security holes that had been in the code for about two decades. The US security agencies CISA and NSA told everyone to update at once, or to take a site offline until they could.

Who found them. AI did, with people guiding it. A security firm called Calif found one hole using an OpenAI model, as part of an OpenAI programme that searches widely used free software for flaws. Wiz, a security company owned by Google, found holes using its own AI agent and AI models from Google and OpenAI. Both worked with the PHP team before going public. OpenAI says the holes were found before any attacker found them.

What happened next. Government services in the Netherlands, Finland and France, among others, went offline for a while as a precaution while they patched. No attacks using the holes had been reported. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything on version 8.1 or older no longer gets fixes and needs an upgrade.

Why this matters beyond one bug. Holes like these have always existed. What changed is speed. AI can now search old code for weak spots much faster than people can. Wiz also warned that AI makes it easier to turn a known hole into a working attack. The same speed is available to defenders and attackers.

Why it matters at sea. Ships keep software longer than almost anyone. Many devices on board have a small web page for their settings: satellite terminals, routers, cameras, tank and engine monitoring, printers. Some of those pages run on old web software, and few are ever updated. On shore, crew portals, supplier portals and company websites often run on PHP.

What to do this week. Ask your IT team or provider whether any company website or portal runs PHP, and which version. Ask your main shipboard suppliers whether their products use PHP or similar web software, and how they deliver fixes to ships. And make sure nothing on board can be reached directly from the internet without a reason that someone has written down. [TechCrunch · The National · Science Times]

This story is part of the Maritime AI Digest of 25 October 2026.