Your biggest security exposure is software you do not own
Boards audit their own code while ignoring the runtime beneath it, maintained by volunteers and updated by a supplier nobody checks.
Sign up for my Substack daily AI newsletter here.
Follow me on LinkedIn: https://www.linkedin.com/in/johanosteyn/
In October 2026, two flaws in PHP, the programming language behind most of the world's websites, sent government departments across Europe and Asia offline while administrators scrambled to patch. The flaws let an attacker run code on a web server with no account and no password, and they had been sitting in the code for decades. What made them remarkable was not their age but how they were found. Frontier artificial intelligence models located what human researchers had not, and then made exploiting them practical. The lesson for boards has little to do with PHP. It concerns the distance the episode revealed between the speed at which weaknesses are now found and the capacity available to repair them, and who carries that risk in the meantime.
CONTEXT AND BACKGROUND
The two vulnerabilities, nicknamed PHP2Shell, were each rated 9.2 out of 10 for severity. PHP runs about 69.7% of websites whose server-side language is known. A security firm found the first flaw using one of OpenAI's models in August 2026, and Wiz, which Alphabet owns, independently found the second. Two months of coordinated disclosure followed. The United States National Security Agency issued a rare public warning, and departments in Germany, France, Belgium, the Netherlands and Finland took websites offline rather than run them unpatched.
Proving the flaws could be exploited had required a chain of steps at the edge of what human researchers could practically manage. Wiz described frontier models as having substantially reduced that barrier.
INSIGHT AND ANALYSIS
The uncomfortable part is not the discovery. It is what the discovery landed on. The PHP Foundation describes the people who secure the language as a small group of foundation-funded developers with a little volunteer help. Since 1 July 2026, that team has published 15 security advisories and worked through more than 100 reports that proved invalid, duplicated or impossible to reproduce, a workload it attributes to AI-assisted research. On its own delay in handling one of these flaws, the Foundation's verdict on itself was blunt. The delay was a structural failure, caused by its decision process and a shortage of resources.
That is the asymmetry. Discovery scales with computing power. Remediation cannot, because patching a runtime that millions of applications depend on requires regression testing and cautious backporting, and a careless fix breaks the web it was meant to protect. Roughly 758,000 internet-facing servers run versions of PHP that no longer receive security updates, against about 272,000 on supported branches. For most of those machines, no patch is coming at all. One researcher estimates that most attackers can now build a working exploit in under an hour with AI assistance.
I have previously written about this in Fifteen Minutes To Detect, Two And A Half Hours To Stop, where an AI agent reached the internet without authorisation and was spotted quickly, while the capacity to stop it lagged far behind. The pattern now repeats at the scale of global infrastructure.
A further question goes unasked: who pays for any of this? The hosting companies and cloud providers that built profitable businesses on PHP contribute very little towards maintaining it, and the organisations whose digital presence depends on it contribute nothing.
IMPLICATIONS
For South African boards, King V makes this a governance matter rather than a technical one. The code replaced King IV in full, applies to financial years commencing on or after 1 January 2026, and carries a principle on data, information and technology. An organisation running a customer-facing platform on an unsupported runtime, with no record of who must patch it, is not meeting that standard.
Kenya offered the response worth copying. Its Ministry of Information, Communications and the Digital Economy told agencies to identify every PHP system, including those run by third parties, take offline anything that cannot be secured promptly, and, where patching is impossible, formally record the residual risk, the compensating controls and the expected remediation date. That final instruction is a governance artefact rather than an IT task.
Four questions belong on the next audit committee agenda. Which internet-facing systems run PHP, including those our suppliers operate for us. Which sit on versions that will never receive another update. Who is contractually obliged to patch them, within what window, and how do we verify a patch landed? Lastly, does our cyber-insurance policy exclude end-of-life software, and have we told the underwriters what we run?
CLOSING TAKEAWAY
A fair reading of October 2026 is that the system worked. Defenders found the flaw first, a coalition repaired it over two months, and the fix arrived before any confirmed breach. The warning sits underneath that achievement. Tools now find weaknesses faster for attackers and defenders alike, and the volume of reports will keep growing, while the human capacity to triage and repair them will not. No board can fund every piece of open-source software its business depends on. Every board can establish what it depends on, who maintains it, and who is obliged to fix it.
Johan Steyn is a prominent AI thought leader, speaker, and author with a deep understanding of artificial intelligence's impact on business and society. He is passionate about ethical AI development and its role in shaping a better future. Find out more about Johan's work at https://www.aiforbusiness.net
Comments