In August, researchers at Calif and Google’s Wiz used advanced AI models to uncover related flaws in PHP, the web language estimated to underpin about 70% of websites. Wiz researcher Sagi Tzadik initially suspected the agent had erred—“Models tend to hallucinate”—but the exploit worked. The rival teams then joined a roughly 15-person effort to trace the bugs and prepare a fix before going public.¹

That coordination was the defenders’ advantage. AI made it possible to test ideas at a pace that had once taken weeks; Tzadik called it “months of traditional research condensed” into hours or days. But the same speed sharpened the danger: attackers needed only one unpatched target, while defenders had to cover them all.¹

By Oct. 21, the clock had started running. Details leaked ahead of the planned patch release, and Amazon Web Services said hackers began attempting to exploit the flaw broadly. The PHP Foundation issued fixes, but the problem sat in the core software—not an individual WordPress plug-in—leaving every unpatched server exposed to possible takeover, data theft or service disruption.²

Over Wednesday and Thursday, governments and companies chose caution over continuity. Britain took 32 services offline; sites in Germany, Japan and the Netherlands were affected; and Finland’s public portals shut down, disrupting routine tasks. Cloudflare saw thousands of exploit attempts before disclosure, then tens of thousands within 45 minutes, hundreds of thousands within two hours and eventually millions.³ One subsequent post said successful exploitation had been observed on honeypot servers, though no second-stage payloads had been recovered.Aravind Srinivas (AravSrinivas)⁴

For ordinary visitors, the immediate risk was limited: simply opening a vulnerable PHP site does not infect a phone or computer. Website operators faced the real emergency—patch immediately, scan exposed systems and, if necessary, take targeted services offline.⁵

The lasting dispute is not whether AI helps security; it plainly did here. It is whether institutions can adapt fast enough when AI also makes exploitation easier for less-skilled attackers. As one cybersecurity expert put it, the old remediation cycle is “broken.”⁶ Toolmakers are already rushing assistance into the gap, offering credits for checks that identify exposed PHP sites and prioritize fixes.Aravind Srinivas (AravSrinivas)⁷