In early August, a Wiz researcher asked an AI agent to test whether a WordPress weakness could apply to Drupal. The agent failed at that task—but surfaced a long-hidden PHP flaw instead. The finding initially drew skepticism because “models tend to hallucinate,” researcher Sagi Tzadik said, before the exploit proved real.¹

That discovery was not isolated. Calif, working with OpenAI, had found a related flaw, and the groups coordinated with PHP maintainers to trace the bugs and prepare a fix. For defenders, it was a rare win: AI had condensed what Tzadik called “months of traditional research” into days or hours.¹ But the same acceleration sharpened the danger. One cybersecurity expert warned that AI had broken the old response cycle, allowing even low-skilled attackers to exploit serious flaws within minutes.²

Then the disclosure began to fray. Details circulated online before the planned patch release; a video inadvertently showing an exploit added to the pressure. By the time PHP Foundation updates arrived, Cloudflare had logged thousands of attempted exploits before public disclosure, then tens of thousands within 45 minutes and millions thereafter.³

Governments and businesses responded by pulling services offline while they patched. Britain took 32 government services down as a precaution; Finnish public sites halted routine tasks; Dutch digital-identity and reporting portals went dark. For large institutions, one small-business operator called the disruption a “speed bump”; for smaller firms, outages stretched to seven hours.³ Tools and services quickly appeared to help administrators assess exposure, including an offer of credits for PHP vulnerability checks from Perplexity’s Aravind Srinivas.Aravind Srinivas (AravSrinivas)⁴

The immediate catastrophe, however, did not fully arrive. Later assessments found that, despite millions of attempts, the PHP bugs were unusually difficult to exploit successfully.⁵ That offered breathing room, not an all-clear. As threat-intelligence chief Samantha Lewis put it, the next crisis “could be three hours from now.”⁵