Two PHP flaws expose 20 years of code and trigger outages

Two PHP flaws expose twenty years of code and force outages across Europe

What happens when the language that powers half the internet breaks in two places at once? On October 21, two critical PHP vulnerabilities —remote code execution with no authentication or user interaction— forced systems offline in Germany and triggered emergency mode around the world. According to the BSI, Germany's federal cybersecurity agency, all versions since PHP 5 are potentially affected: twenty years of code in production. The list of victims includes the federal police, customs, the Robert Koch Institute, hospitals such as Berlin's Charité, fire departments, universities and state administrations. The same day, Node.js patched ten flaws —four critical— and Go did the same.

Who found the flaws and who knew beforehand

The discovery did not come from a human with caffeine and a debugger. It was GPT-5.6 Sol, from OpenAI, according to the account circulating in the industry, which the firm Wiz calls the most serious discovery ever achieved with this technology. The White House had known since Friday, October 16; OpenAI coordinated disclosure with CISA and the Office of the National Cyber Director. Five days of selective silence while three quarters of the internet remained exposed. In the end, the leak precipitated the chaos: that is why the outage is happening now and not next week.

The underlying problem: not having your own models

This is where the real gap shows. Those without their own AI models depend on those who have them to find out that their infrastructure is leaking. The warning has been on the table for years: Europe cannot afford to be a customer of the AI that audits its own systems. This time it worked out. Next time, with the certificates of an Indian authority compromised —keys that should be 116-digit numbers, one of which had four— maybe not.

Is it that serious? The patch exists and it's one command

Some argue that updating PHP is a one-command job and that the alarmism is overblown. True in theory. In practice, hospitals, fire departments and entire administrations run on stacks of software nobody has touched in a decade. The FBI recommended shutting down servers. That is not a cosmetic measure. The gap between the patch available and the patch applied is where disaster lives.

Critical infrastructure and the DVD as plan B

The conversation quickly drifted to the usual question: if the internet goes down, what goes down with it? The uncomfortable answer is that most essential services —healthcare, emergency response, government— depend on networked connections nobody designed to work offline. Against that, popular ingenuity: keeping what matters on physical media, reading on a desktop PC and distrusting the cloud. DVD porn as secure critical infrastructure sounds like a joke, but it sums up a truth: resilience is built off the network.

---

In the end, the question is not whether the next critical flaw will arrive. It is whether someone will have updated the server before GPT-7 finds it. And with these timelines, betting on the untouched server is the most human option.