Xataka's analysis, published on 22 October 2026, presents the PHP crisis as a particularly serious example of the wider fragility of internet infrastructure. PHP runs on servers and generates dynamic pages. It is used by about 70% of websites, so a defect in its core can affect many applications, even when their own code is sound. Operating systems, browsers and server software contain many vulnerabilities, and some remain hidden for years.

OpenAI, Google and other AI laboratories are applying frontier models to find PHP vulnerabilities. The systems can produce exploitation tests and assess fixes proposed by engineers. The analysis highlights the dual-use risk. AI can expose structural weaknesses, but it can also reduce the time and expertise attackers need to turn a known flaw into a successful attack. Anthropic's launch of Mythos Preview at the beginning of April is cited as an earlier sign of this debate.

The vulnerabilities behind the current crisis may allow remote code execution without authentication. Public and private organizations took parts of their infrastructure offline the day before publication to limit the risk. A compromised server could expose sensitive data or disrupt essential services such as banking platforms and hospital appointment systems. Unemployment-benefit platforms carry the same risk.

The article stresses that PHP's 70% reach is not a count of successful intrusions. The number of sites using PHP differs from the number running an exposed version and configuration. A third, smaller count covers sites that were actually compromised, and that figure was not yet known. It could emerge in the following weeks.