The PHP security crisis in 2 numbers

If your site runs an old PHP branch, the PHP security crisis is your problem this week, not next quarter. A patch is available, but roughly three quarters of tracked services run older versions that are slower to update, which is where the risk concentrates.

What is the PHP security crisis and why did AI cause it?

The PHP security crisis is a critical vulnerability in PHP, a widely deployed server-side scripting language, that was found with AI assistance and that can let an attacker send instructions without logging in. Sky News technology correspondent Rowland Manthorpe framed the episode in a 22 October 2026 report as first an AI problem and second a patching problem PHP security crisis coverage.

The mechanism is capability, not magic. Language models became markedly better at reading code and spotting exploitable gaps, and that skill is not reserved for defenders. The same class of model that helps a researcher triage a bug can help someone else look for one.

Manthorpe's claim that AI suddenly improved at vulnerability discovery rests on charts shown in the segment rather than on a study named in the transcript. Treat the shape of that curve as broadcaster-reported evidence, not as a peer-reviewed measurement.

The PHP security crisis in numbers

The PHP security crisis is large because PHP is everywhere. Manthorpe gave a range rather than a single figure: some estimates put PHP on 45% of websites, others near 70%, and the method of counting changes the answer. That range is his summary of published estimates, not a figure this article verified independently.

Exposure is only half the story. The other half is whether sites can update, and the segment's patching data suggests most cannot do it quickly.

How the patch and adoption gap compare

The PHP security crisis is partly solved on paper and only partly solved in practice. A patch exists, but the population of installations that can absorb it quickly is much smaller than the population that needs it.

The figures below come from the dataset Manthorpe displayed in the Sky News segment, covering about 2.6 million services. They describe what that sample showed on the broadcast date, not the state of the internet in general.

Why AI-assisted attack volume has not arrived yet

The PHP security crisis has not yet produced the attack surge many expected. Manthorpe tracked reported ransomware victims over time and found no visible jump after the models improved, which he described as looking for a bump that was not there.

His explanation, drawn from people who monitor criminal forums, is economic. Ransomware crews are earning well with existing methods, so retooling around AI would cost time and effort for uncertain gain. That is a second-hand account of attacker incentives, not a measured survey.

Two caveats matter. First, reported ransomware victims are a lagging and partial measure, so the absence of a spike is weak evidence of absence. Second, the capability gap between closed and open-weight models is narrowing, and open-weight releases often ship without the safety filters applied to hosted assistants.

What changed for defenders after this episode

The PHP security crisis changed the timetable for defenders more than it changed the theory. Detection now moves faster than routine maintenance, so the bottleneck has shifted to inventory and patching capacity.

Manthorpe noted that some public bodies took sites offline during the episode, which he read as buying time to upgrade rather than as evidence of a breach. That reading was explicitly his speculation.

Cloudflare's Matthew Prince reported hundreds of thousands of attacks within two hours of the vulnerability's announcement, the kind of figure that belongs to a network operator's telemetry rather than to independent measurement.

Where this leaves the attack-defence balance

The PHP security crisis leaves the balance tilted toward attackers in the short term and open in the long term. Models make vulnerability discovery cheaper for everyone, which raises the value of keeping software current.

Unpatched installations remain the practical risk. A fix that sits unapplied protects nobody, and three quarters of tracked services running older branches is a capacity problem that no model resolves.

FAQ

• Is there a patch for the PHP security crisis? Yes. A patch was available at the time of the 22 October 2026 Sky News report, but sites running older PHP versions face a harder upgrade path before they can apply it.

• Does AI make hacking automatic? No. Manthorpe described AI as improving vulnerability discovery and exploitation support, while noting it is not a single-button attack tool. Skilled effort and setup remain necessary.

• Why are some government websites offline? Manthorpe speculated that some public bodies took sites down to buy time for upgrades. He said he had no confirmation of that reason, so treat the explanation as inference.

• Should you upgrade PHP now? If you run an unsupported PHP branch, the case for moving to a maintained release is strong regardless of this incident. Exposure comes from unpatched installations, not from the language itself.

Source video