Story
Oct 27, 2026
AI Found PHP’s Hidden Flaw, Then Forced the Web Into a Patch Race
AI-assisted researchers uncovered critical, decade-old PHP vulnerabilities, but a leak before the patch rollout accelerated exploitation attempts and pushed governments and companies to take sites offline. Defenders see a breakthrough; security officials see a warning that response systems must move faster.
The alarm began in August, when security researchers used advanced AI tools to probe old web infrastructure. At Wiz, an AI agent failed to adapt a WordPress weakness to Drupal—but surfaced a separate PHP flaw instead. Researcher Sagi Tzadik initially assumed the model was wrong: “Models tend to hallucinate.” The exploit nevertheless worked, exposing a weakness that had sat undetected for more than a decade.1
That discovery carried an important caveat amid claims of an AI-only breakthrough: human researchers at Wiz and Calif still had to verify, understand and responsibly report the bugs. A roughly 15-person group then worked across rival firms and the PHP project to trace the flaws and prepare a fix—an effort Wiz’s Tomer Schwartz described as “just based on trust.”1
The coordinated process began to fray before the planned release. Details circulated online, and Chainguard CEO Dan Lorenc released information early, saying he believed the flaw was already being exploited; the PHP Foundation said the move broke the embargo and disregarded weeks of coordination.2
By Wednesday and Thursday, the consequences were visible from Helsinki to New York. Governments and companies temporarily pulled services offline while applying the PHP Foundation’s patch. Cloudflare said it saw thousands of exploit attempts before public disclosure, then tens of thousands within 45 minutes, hundreds of thousands within two hours and eventually millions.3
For defenders, the episode was both a near miss and a new operating reality. One cybersecurity expert warned that AI can let even low-skilled attackers exploit critical bugs within minutes, making the traditional sequence of assessing exposure, assigning remediation and patching “broken.”4 The practical response remains decidedly unglamorous: identify PHP-dependent systems, scan them and update immediately—rather than assume every vulnerable site must go dark.
AI companies and toolmakers are already turning the scare into defensive automation. Aravind Srinivas said his company was offering credits for PHP vulnerability checks, including a tool designed to prioritize fixes.
5 But the central tension remains: AI may find vulnerabilities faster for the good guys, while ensuring that once a secret escapes, the bad guys can race just as quickly.