The NSA just told companies to pull their websites offline if they can't patch them right away. The reason is a bug that's been sitting in the code behind 70% of websites for 14 years. Last Friday a guy found it in one evening by typing five words into an AI. Those five words were "find bad vulnerabilities in PHP." He's Dan Lorenc, CEO of a security company called Chainguard, and all he had going in was a rumor that something big was coming in PHP. A small firm called Calif had already found the same flaw back on August 1 using OpenAI's GPT-5.6 Sol. Wiz, the security company Google bought, found it on its own less than three weeks later with Gemini and GPT. Since then OpenAI, Wiz, Calif and PHP's maintainers have been quietly building a fix that Lorenc himself called "crazy." You'd think a bug this bad would've gotten caught sometime since 2012. PHP is open source, so anyone on earth could read this code. Wiz says turning the flaw into a working attack took a chain of steps right at the edge of what human researchers could realistically pull off. For 14 years the sheer amount of work was doing most of the protecting. AI made that work cheap enough to knock out on a Friday night, for anyone who knows where to point it. And the rumor got out. Bug ID numbers started floating around online Tuesday. Hours later one of the research teams posted a video of the exploit by mistake, and PHP moved its release up a day. Early Wednesday, Chainguard pushed its fix out more than six hours ahead of everyone else, saying people were already getting attacked, and Lorenc says his company's decoy servers caught IP addresses from China and Russia going after the flaw. Here's why the NSA went straight to "unplug it." VirusTotal counted about 758,000 exposed servers running old PHP versions, 5.4 through 8.1, that don't get security updates anymore. Only around 272,000 are on versions that do. So for roughly three out of four servers that show their version number, there's no patch to install, and pulling the plug is the only fix they've got. This is happening everywhere at once, too. Microsoft just fixed 1,413 vulnerabilities in a single month, more than in any full year on record. OpenAI says it expects finds like this one to jump sharply over the next few months. Every company sitting on a secret bug now has until the first rumor leaks and somebody with an AI subscription goes looking.