Story
Oct 24, 2026
AI Found PHP’s Hidden Flaw—Now Defenders Are Racing the Hackers
AI helped researchers uncover critical, decades-old PHP flaws before attackers could fully exploit them. But leaked details and rapid attack attempts forced governments and companies to choose between patching fast or going dark.
In August, separate teams at Calif and Google-owned Wiz used advanced AI tools to probe PHP, the web language estimated to underpin roughly 70% of websites. What they found were two critical vulnerabilities—later dubbed PHP2Shell—that had remained buried for more than a decade. Wiz researcher Sagi Tzadik initially suspected an AI error: “Models tend to hallucinate.” But the exploit worked.1
The discovery offered a rare defensive win. Researchers coordinated privately with the PHP Foundation and major infrastructure companies to develop patches before going public. OpenAI called the flaws “one of the most impactful security issues in recent memory,” while warning that the same AI capabilities could rapidly help attackers build offensive tools.2
That advantage began to erode in October. Amazon said it detected an exploit attempt on October 17, days before the planned disclosure, while reports and an accidentally posted proof-of-concept video accelerated the scramble. Once news spread, Cloudflare recorded thousands of attempts before disclosure, then tens of thousands within 45 minutes, hundreds of thousands within two hours and ultimately millions.3
On Wednesday, the PHP Foundation released emergency patches. The NSA and other agencies advised organizations unable to update immediately to take systems offline. Governments from Finland and the Netherlands to Japan did just that; Britain said 32 public services were temporarily unavailable. For users, the disruption was mundane but telling: Helsinki developer Kalle Pusa could not arrange collection of an old sofa, saying the digital infrastructure “woven into the fabric of our society” had been torn.4
The incident has sharpened a divide in the cybersecurity world. Optimists argue AI exposed a disaster before it fully unfolded; operators of aging, unsupported systems say the speed of AI-assisted exploitation has broken the old patch-and-plan cycle. As commercial tools rushed in, Aravind Srinivas promoted free credits for an AI service that checks PHP sites and deployment configurations for exposure.
5
For now, patches are available and confirmed compromises remained limited in early assessments. But PHP2Shell has made the new reality plain: AI may find the internet’s deepest flaws first—without guaranteeing defenders enough time to fix them.