In early August, Wiz researcher Sagi Tzadik asked an AI agent to test whether a WordPress weakness might also affect Drupal. It failed at that task—but surfaced a separate flaw in PHP, the decades-old language underpinning both platforms and much of the web. Tzadik initially suspected a false positive: “Models tend to hallucinate.” The exploit nevertheless worked, exposing a weakness that had escaped notice for more than a decade.¹

The discovery offered a case for AI as a defensive tool. Calif researchers, working with OpenAI, had independently found a related problem; the groups reported their findings and joined PHP maintainers in a roughly 15-person effort to trace the bugs and prepare a fix. AI can scan code at a scale human teams cannot match, but the same capability can help attackers identify exposed systems and automate exploitation—making rapid, coordinated disclosure essential.²

That race tightened when details began circulating online two days before the planned patch release. PHP maintainers moved the release forward, but a Calif video inadvertently demonstrating the exploit helped trigger copycat activity. Cloudflare saw thousands of attempts before disclosure, then tens of thousands within 45 minutes, hundreds of thousands in two hours and eventually millions.¹

By Wednesday and Thursday, the patch was out—but the precautionary shutdowns had begun. Britain took 32 government services offline; public sites in Finland, the Netherlands, Germany and Japan were disrupted, while companies and small businesses rushed to update. For institutions with large IT teams, one business owner called the interruption a “speed bump”; for smaller firms, outages stretched to seven hours. A Nairobi IT operator feared slow-moving public systems could still be attacked.³

The response is now being commercialized as well as coordinated: Aravind Srinivas said users could receive credits to check PHP sites and deployment configurations for exposure, an illustration of how quickly AI-assisted scanning is moving into routine defense.Aravind Srinivas (AravSrinivas)⁴

The lesson is not that AI solved the problem. It found it early enough for defenders to act—and revealed how swiftly that head start can evaporate.