The PHP Crisis Was a Decision-Making Crisis

You could be forgiven for mistaking the PHP crisis for simply a technical story for cybersecurity wonks. I certainly did, giving it only a brief nod in our last Ultrathink. But lots of people are talking about it, including some of my colleagues.

Most coverage of the crisis focuses on AI finding vulnerabilities, attackers trying to exploit them, and governments pulling websites offline. And that’s all true. But here’s the part not getting quite enough attention: a small, underfunded team had known about one of the underlying weaknesses since 2024 and couldn’t decide what to do about it.

What even is PHP?

PHP is a programming language older than many of the people reading this. It is also essential to most websites, and about half of those websites run versions so old they no longer get official security updates. PHP is maintained by a small community of core developers, supported in part by the PHP Foundation, which runs on a lean budget. For many, it’s a labor of love.

What actually happened?

A couple of years ago, devs identified a security weakness, but nobody had demonstrated how to turn it into a serious attack. Fixing it was complicated because changes could break existing software. They still tried, but every fix they came up with had a serious downside. Because they couldn’t agree on a fix, the de facto solution was to kick the can down the road.

Then shit got real

Fast forward to August of this year, researchers using AI figured out how to exploit PHP’s weakness to make servers execute malicious commands. This was different from some of the more targeted explorations we’ve seen recently. It was more akin to figuring out lead pipes or asbestos were toxic for humans to live with.

What do you do when that shit is everywhere?

By October 17, Amazon was detecting attempted attacks, four days before the vulnerabilities were publicly disclosed. On October 21, the PHP project released emergency fixes. The emergency was messy, and not all of it was the Foundation’s doing. A researcher accidentally posted a video of the exploit, and one company released patched software hours ahead of the agreed time.

As of this writing, there have been millions of attempted attacks, but no publicly confirmed break-ins. Nevertheless, governments across Europe pulled their websites offline.

So why did it sit there so long?

The first and easy story to tell was underfunding. Comical, absurd, ridiculous underfunding for infrastructure this important. We’re talking the Foundation’s two staff members, 13 engineers (some full-time, some part-time), and 10 unpaid board members. You couldn’t staff a Cracker Barrel with that, let alone maintain a piece of core internet infrastructure. The Foundation took in about $730,000 in donations last year. Meanwhile, OpenAI, whose models helped find this bug, has committed $1 billion in subsidized access to its AI tools for security teams with limited resources. OpenAI also paid for the security review that found the bug and gave PHP’s team access to its tools.

Beyond that, three major reasons stand out:

• They didn’t know it could be used to break into a server
• Fixing it could make it worse or cause negative ripple effects
• Their decision-making process couldn’t reach consensus about how much “bad” was acceptable.

Because the team ran on consensus, it struggled to land on a fix. Considering the lack of a known attack until August, the effort turned into repeated stalling and restarting. The PHP Foundation itself said it outright: the delay was “a structural failure.”

The big takeaway

You can have the technical ability to fix a problem, but without leadership and clear decision-making processes, problems can rot like a bad tooth. Not being able to settle on a choice meant that they were, on some level, waiting for an external event to force some kind of reckoning. Which of course happened. But waiting for certainty is a decision too, and AI is making it a riskier one. Tellingly, the Foundation’s fix is a process fix: moving from consensus to majority decisions on hard calls.

There’s no evidence that these people somehow were not thinking about this problem. They clearly were. But human beings still need to be able to coordinate and make choices, even when no real choice is terribly appealing. AI, of course, cannot fix a flawed decision-making process, and in cases where AI is not on your side, it can make delaying decision-making entirely untenable.