A 22-year-old flaw became a crisis in 48 hours. Half the press missed it.
PHP, the programming language running roughly 70 percent of the world's websites, has carried a severe vulnerability for 22 years. AI tools found it, weaponized the attack surface, and turned a dormant risk into an active crisis inside two days. CNN and NPR have the story. Right-leaning outlets, which reliably cover AI risk when it touches regulation or Big Tech, have published nothing. The gap is not ideological — it's a blindspot worth naming.
Critical internet security flaw affects 70% of websites, AI accelerates threat
2 sources · hover a dot to see coverage
What happened
Security researchers, aided by AI, identified severe vulnerabilities in PHP, a programming language that underpins an estimated 70 percent of websites globally. The AI-assisted discovery accelerated both the identification of the flaw and the speed at which hacking attempts followed, compressing what might have been a weeks-long disclosure process into roughly 48 hours. Governments are now moving to implement protective measures. CNN framed the event as the largest internet security threat ever recorded, noting the vulnerability had existed for 22 years before AI made it actionable at scale. NPR reported a surge in hacking attempts following the disclosure. That is the factual core. Two outlets have it, both left-of-center, and the rest of the coverage map is empty.
CNN and NPR covered it; the framing gap is between them
CNN's headline is the more aggressive of the two: 'The biggest-ever internet security threat has been known for 22 years. AI made it a crisis in 2 days.' That framing centers AI as the accelerant, not just a tool, and treats the 22-year dormancy as the story's indictment. NPR's headline focuses on the consequence already in motion: hacking attempts rising after the disclosure. The two framings are compatible but distinct. CNN asks how we got here; NPR reports what is happening now. Neither outlet reported the other's angle.
What one side told you that the other didn't
Right-leaning outlets that cover AI risk published nothing.
Outlets that have spent considerable bandwidth on AI danger, regulatory overreach, and Big Tech accountability are absent from this story entirely. A vulnerability affecting 70 percent of websites, accelerated by AI into an active attack window in 48 hours, sits squarely inside the beats those outlets staff. The absence is not explained by timing or geography. The story has been live long enough to cover. Readers who get their news from right-leaning sources have no version of this event at all.
The 22-year timeline appears in one outlet, not both.
CNN's framing that the flaw 'has been known for 22 years' is the detail that reframes the entire story: this is not a new vulnerability discovered by AI, it is an old one made newly dangerous by AI. NPR's coverage does not include that timeline. Readers of NPR's version get a story about rising hacking attempts; readers of CNN's version get a story about institutional failure spanning two decades. Those are meaningfully different stories about the same event.
What to watch
If hacking attempts produce a confirmed breach of a major platform or government system in the next seven days, right-leaning outlets will almost certainly enter the coverage — and the AI-as-accelerant framing will compete with a regulatory-failure framing. Watch whether the first right-leaning entry credits or omits the 22-year dormancy detail, since that single fact determines whether the story reads as a technology crisis or a government one.
This kind of gap — where one side reports a fact and the other doesn’t mention it — shows up in about 40% of major stories.