The 20-Year-Old Hole
The hole had been there since 2004. It was not born yesterday. Everyone had been walking right over it. This week the NSA issued an urgent warning. Two critical flaws hidden inside PHP. They date back to 2004. For 22 years, countless websites around the world ran with those holes inside them. Nobody knew. And what found them was not a human hacker. It was AI. GPT-5.6 Sol and Google Wiz's AI stack caught them before attackers did. Patches are out. Sites that cannot patch were told to take themselves offline. PHP is the plumbing of the internet. You pass over it every day without knowing its name. A large share of the world's websites run on PHP. That plumbing had two holes in it for 22 years. 2004 was the year Facebook was founded. Code from that era was still running underneath today's internet. Up to here it sounds like good news. AI won one for the defense. But the line Wiz added is the real story. These flaws were always too complex for human hands to exploit. That is how they survived 22 years. AI just lowered that bar. AI finds, and AI digs in. This time the defense was first. Discovery itself is neutral. It reached good hands first this time. Nobody knows whose hands find the next hole first. Some have pointed out that the discovery itself needed no special tooling. Ordinary tools found it. That is scarier. Those tools are now in everyone's hands. Yesterday brought a similar scene. A report of one hacker using an AI agent to breach a hundred companies, at the cost of a few cups of coffee per break-in. Look around, and the internet stands on old things. Code nobody reopens. Systems whose makers have left. Servers nobody can explain. What protected all of it was never strength. It was indifference. Searching cost too much, so nobody searched. Digging cost too much, so nobody dug. Security was never a question of skill. It was a question of cost. The defenders were priced out too. Looking inside cost so much that leaving a working system alone was the rational choice. Indifference was not laziness. It was arithmetic. And while that arithmetic held on both sides, the world stayed quiet. AI collapses that cost on both sides. Checking gets cheap. Attacking gets cheap. What remains is speed. From discovery to disclosure, disclosure to patch, patch to applied. Every gap in that chain is risk. A system that delays the patch lives with an open door. The real lesson of a hole that survived 22 years is this. Old is not dangerous. Unlooked-at is dangerous. They were not abandoned. They were forgotten. Forgotten things pile up quietly. Code does not age like wine. It rots like a bridge nobody inspects. An age is coming where maintenance is the skill. Building new things is already cheap. Knowing what you inherited, knowing what has worn thin, and keeping watch. Unglamorous work. But that is where the gap will open from here. The things we stand on every day. When did anyone last check them?