Story
Oct 23, 2026
AI Found PHP’s Buried Bug, Then the Web Had Hours to React
The PHP crisis is being read two ways: as a rare defensive win for AI, which helped expose a long-hidden danger, and as a warning that the same tools have compressed the time available to protect the internet’s oldest infrastructure.
The trouble began in August, when researchers at Calif and Google-owned Wiz separately used AI systems to probe PHP, the decades-old language behind WordPress, Drupal and, by some estimates, roughly 70% of websites. Calif used OpenAI’s GPT-5.6 Sol; Wiz combined its Atlas agent with Gemini 4 Argon and GPT-5.6 Sol. Their discovery: two critical flaws, collectively called PHP2Shell, that could let an unauthenticated attacker run code on a vulnerable server.1
The bugs had sat in PHP for years, in part because building an exploit once demanded an unusually complex chain of technical steps. Wiz’s warning was stark: AI can now adapt an exploit across “different PHP versions, configurations and memory layouts.”2 That made coordinated disclosure less a routine software update than a race against the clock.
When details leaked ahead of the planned release, the PHP Foundation expedited patches to Wednesday morning. Governments and companies were told to update immediately or pull systems offline. Japan’s prime minister, Sanae Takaichi, called for urgent action, saying temporary suspension could be an effective way to reduce risk when rapid patching was impossible.3
The shutdowns spread from Finnish and Dutch public services to British government sites, while businesses scrambled through the same disruption. For Kalle Pusa in Helsinki, even arranging collection of an old sofa had to wait: essential digital services, he said, are “woven into the fabric of our society,” and that fabric had been torn.4
Attackers moved fast. Cloudflare recorded thousands of exploit attempts before disclosure, then tens of thousands within 45 minutes, hundreds of thousands within two hours and eventually millions.4 Yet the picture remained contested: the PHP Foundation said it had no evidence of working exploits, while Amazon telemetry reported an attempted PHP2Shell exploitation before the patch.5
For users, the immediate burden sits with site operators—though security specialists warn compromised services could expose personal data. One practical response is already being commercialized: Aravind Srinivas said Computer was offering credits to check PHP vulnerabilities, with a tool that scans sites and deployment configurations and prioritizes fixes.
6