James Ball
Tech, policy, politics.
“The PHP Foundation, it turns out, its income is less than a million dollars a year. It has fewer than 11 staff and most of the code updating is done by a small team of volunteers. You know, this is the classic, again, crumbling infrastructure thing. But they actually got ahead of it and sort of said, well, someone's got to use AI and find any mistakes in the code. Why don't we do that? And they did. And they found it.”
Smashing Security · Software Engineering & Infra · October 2026
Context
Asked how the PHP flaw was discovered, James explains that the PHP Foundation sought help from an AI lab to audit its old code, and researchers found the hole. The line shows how small the team is behind software that much of the web runs on.
Transcript
it's quite a nice language to use, isn't it? It's quite natural language. It's quite. Easy to write. I enjoy it. Like people tend to like PHP who use it.
But even if you were running the latest version of PHP, it was vulnerable to this huge security hole. But what was interesting was how this security hole was discovered and how it became front page news.
…available. And the problem with PHP is it's loads of stuff you wouldn't think about. Like your router has a little admin page for its settings. Your printer will have a little PHP-powered admin page, et cetera. So people will remember the obvious stuff. And that's what they'll have been fixing the last 24 hours. There's got to be so much little hidden layer infrastructure stuff running it. The PHP Foundation, it turns out, its income is less than a million dollars a year. It has fewer than 11 staff and most of the code updating is done by a small team of volunteers. You know, this is the classic, again, crumbling infrastructure thing. But they actually got ahead of it and sort of said, well, someone's got to use AI and find any mistakes in the code. Why don't we do that? And they did. And they found it. So that's good. Yes. And then essentially they worked to patch it. And as I understand it, over the last week or so, they've been trying to notify particularly critical infrastructure people. And they were planning on putting it out, I think, on the 22nd. But by the 20th, it was obvious that word had got out and that attackers were starting to use it. And so they disclosed it slightly earlier…
And maybe someone who was inside the kimono, as it were, of knowledge of like, we've got this issue, guys, which we're trying to fix. And we only really want to make it public once we know we're ahead of it and that some critical parts of the internet have already been updated and protected.…
mean, I work for a university. All of our course materials and our timetables got taken down. And so we had emails from IT going, still go to your classes, still do your classes, but you can't look up where they are and you can't get the teaching material that's on the intranet. So it was a tricky…
different levels of importance. There were government websites, there was your university, and there was my local chess club, all impacted to one extent or another with this PHP issue. And on top of the TLS issue, you do begin to think, oh, my goodness, there are so many vulnerable, flaky parts of…
More from Smashing Security
