Story
Oct 22, 2026
AI Found PHP’s Decades-Old Flaws—and Now the Web Is Racing Attackers
The PHP crisis is being cast as both a defensive breakthrough and a warning: AI helped researchers expose flaws humans had struggled to turn into exploits, while governments and security experts fear the same tools are collapsing the time available to respond.
The roots of the emergency stretch back years. One of the underlying problems had been flagged to the PHP Foundation in 2024, but no fix followed; the foundation later called that lapse a “structural failure” in its security process.1 The flaws remained buried in PHP, the web language used by roughly 70% of sites, in part because exploiting them required an unusually complex chain of technical steps.
That changed in mid-August, when Calif researchers using OpenAI’s GPT-5.6 Sol and a separate Wiz team using AI tools uncovered two critical vulnerabilities, later dubbed PHP2Shell. The bugs could enable unauthenticated remote code execution—effectively letting an intruder seize a server, access data or alter a website without a password. OpenAI framed the result as proof that “frontier AI found these vulnerabilities before attackers did,” while conceding that the same capabilities can rapidly produce offensive tools.2
The protective lead evaporated this week. A proof-of-concept video was accidentally posted on Tuesday, details spread online, and PHP moved its planned Thursday patch release forward to Wednesday. The NSA urged operators to patch immediately or take systems offline; government sites in Europe, along with services ranging from the Internet Archive to older games, temporarily went dark. Amazon said it had seen an exploit attempt four days before the public disclosure and warned the flaws were being “broadly exploited in the wild.”3
That is the central tension: AI may have found the danger before criminals did, but it also makes replication much faster. Security researchers say the old weeks-long cycle for developing exploits has compressed sharply; website owners now face a blunt choice between rapid updates and outages. For ordinary users, the immediate risk is indirect—compromised services can expose credentials and payment data—so experts advise unique passwords, two-factor authentication and vigilance for breach notices.4
As the patching rush continued, AI companies also turned the incident into a remediation market. Aravind Srinivas said Computer was offering credits to check PHP sites and GitHub deployment configurations for exposure, underscoring how automated scanning is becoming part of the response as well as the threat.
5