Old Code Meets New Speed
AI systems are now taking dormant bugs in PHP code and turning them into working attack tools at a pace that outstrips manual patching. Reports show large language models can read vulnerable functions from public repositories, build a working proof of concept, and chain it into remote access or data theft without any human expert guiding the process. What once took weeks of specialist work can now happen in hours once the source code is visible online.
This change sits within a wider pattern where AI lowers the skill barrier for attackers. Similar tools have already sped up the discovery of weaknesses in other languages and frameworks. The PHP case stands out because the language still powers a large share of websites and internal tools, including many built years ago and left with minimal updates.
Risks for Smaller UK Businesses
Many smaller firms rely on PHP-based content systems, custom extensions or older web applications that have not received recent security reviews. A single overlooked memory flaw from 2008 or earlier can now become the starting point for an automated campaign. The practical result is higher exposure for businesses that lack dedicated security teams or regular code audits. Attackers no longer need to target only the newest software; they can profit from the long tail of legacy code that still runs day-to-day operations.
Cost pressures often mean smaller organisations delay upgrades or continue using extensions that are no longer maintained. AI-driven exploit generation removes the previous safety margin that came from obscurity. A business could face data loss or service disruption from a flaw it did not know existed until the attack lands.
What to Watch Next
Security firms are beginning to test AI-assisted scanning tools that look for the same classes of PHP weakness before attackers do. Business owners should ask their web developers or hosting providers whether routine checks now include these newer methods. At the same time, pressure is growing on software maintainers to issue clearer guidance on retiring or hardening older PHP components. Firms that map their critical web applications and set a timetable for updates will reduce the window in which AI can turn old bugs into live problems.