AI found a hole in the code under up to 70% of websites. Two governments pulled sites offline.

A flaw hid for decades in software behind much of the web. An AI model helped find it in August. The hackers got a four-day head start, and now the race is on to patch.

By Sean Anees Saifi · Capital Wealth · Published Friday, October 23, 2026 · Source: The Wall Street Journal, Friday, October 23, 2026, whose market figures are the Thursday, October 22 close (Business & Finance)

Key Points

PHP, created more than 30 years ago, powers up to 70% of the world's websites, by some estimates. Its creators disclosed the flaw on Wednesday, Oct. 21.
A researcher found it in August using an AI model, during an audit paid for by an AI developer. A few dozen requests can take over a small server in seconds.
The fix touched close to 200 files and more than 10,000 lines of code. A leak on Tuesday forced the patch out a day early.
Webmasters for the Dutch and Belgian governments pulled sites. The NSA and FBI issued warnings. Amazon saw the first attacks on Oct. 17, four days before the patch.
A separate Journal report covers LLMjacking. Hackers steal AI access keys and run campaigns that burn over a billion tokens, hundreds of thousands of dollars, on the victim's bill.

70%

Share of the world's websites that may run PHP, by some estimates

10,000+

Lines of code written for the fix, across close to 200 files

127,000

Outside requests Symantec's decoy AI service logged, May to September

100,000

Steps one hijacking agent could run with no human in the loop

A lone worker bows his head at a lamp-lit desk in a dark open office at night, a laptop and coffee cups beside him, city lights beyond the windows.

Amazon says it saw the first signs of the PHP flaw being exploited on Oct. 17, four days before the patches.

In one line: AI helped find a decades-old hole in the code behind much of the web. Hackers got a head start, and the fix may be a patch you have to ask for.

On Wednesday, Oct. 21, webmasters for the Dutch and Belgian governments did something simple. They switched websites off. They'd rather go dark than risk a hole in 30-year-old software letting someone in. The hole is in PHP, a programming language that by some estimates runs up to 70% of the world's websites. An AI model helped find it.

Robert McMillan and Isabella Simonetti at the Journal call it a cybersecurity crisis. PHP is less popular than it once was, but it's still widely used. You'll find it in government sites, small-business sites, WordPress and Wikipedia. Security experts say it's been around so long that some firms have lost track of it.

A researcher at a security company called Calif found the flaw in August. An AI model helped, during an audit of PHP's code paid for by an AI developer. Someone had flagged this kind of bug decades ago, but it was judged too hard to exploit and forgotten. With AI's help, the researcher cracked it. A few dozen requests can take over a small server in seconds, or a complex one in hours. Calif's chief executive, Thai Duong, worried about hackers running AI against the patches. “All hell will break loose,” he said. A leak on Tuesday forced the patch out on Wednesday, a day early.

A four-day head start

Amazon (AMZN), which runs internet infrastructure, says it saw the first signs of the bug being exploited on Oct. 17. That's four days before the patches. The NSA and FBI issued warnings, and the NSA said the risks require immediate patching across U.S. government agencies. Hackers already claim they've used AI to find ways in. A crisis this big hits widely used software about once a decade, the Journal says. This is the first one since AI got good at hacking.

Thursday's paper had a second trap for business owners. Angus Loten of WSJ Pro reports on LLMjacking. Hackers steal AI access keys, often scraped from code posted to sites like GitHub, and run their own campaigns on the victim's account. Symantec's decoy AI service logged 127,000 outside requests between May and September. About a third looked like tests of stolen keys. AI services bill by the token, a small chunk of text. A big campaign can burn over a billion of them. At top models' prices of hundreds of dollars per million tokens, that's hundreds of thousands of dollars on somebody else's bill.

Our read

Insurance and Consumer Protection, M11, for anyone who owns a website or an AI account. We hold Amazon at weight in 19 books and Google (GOOGL), whose Wiz team found exploits on its own, in 28. Nothing added. Your website is the bigger story. If it runs WordPress or anything built on PHP, it may be exposed, and some owners may not know they run it. Your web host should know. For families, be alert for hacked-site scams this month, and don't type a password into a page that looks odd.

Three things in your business plan touch this story. Your website, your AI account and your cyber policy. This week, get the patch confirmation from your host in writing. Then log into the AI account, set a monthly spending cap, turn on a usage alert, and rotate any key that ever sat in a code repository. Then read the cyber policy for runaway usage charges. A stolen key usually shows up first on the bill. You check the roof before the storm. If you'd like a second set of eyes on the policy language, it's a quick item for your next review.

What It Means For Your Portfolio

Hold. Patch the site, rotate the keys, cap the bill

A flaw in the code under much of the web means your website, your AI keys and your cyber policy all need a look this week.

General planning principles, not advice for anyone in particular. Ask your web host in writing whether PHP is patched. Rotate any AI or cloud key that ever sat in code, and put a spending cap and a usage alert on the account.

Read your cyber policy for runaway usage charges. For the household, be wary of odd pop-ups and downloads on small sites this month, and use two-step login.