Story
Oct 27, 2026
AI Found a Web-Wide PHP Flaw—Then Patching Became a Race Against Attackers
The PHP2Shell scare offered a paradox of the AI age: the same technology that gave defenders an early warning also compressed the time available to act. Security teams saw a successful coordinated response under extreme strain, while governments and smaller operators confronted how exposed the web remains.
August: Researchers at Calif and Google’s Wiz used advanced AI systems to uncover related flaws in PHP, the decades-old web language behind an estimated 70% of sites. The discovery vindicated the case for giving defenders powerful models first: AI had surfaced a weakness that had sat undetected for years. Yet Wiz researcher Sagi Tzadik warned that the breakthrough also meant “months of traditional research” could be compressed into hours or days.1
Days before the planned disclosure: that advantage began to fray. Details of the vulnerabilities circulated online, and a proof-of-concept video was briefly posted before patches were due. The PHP Foundation said Chainguard had “unilaterally broke the embargo,” while Chainguard’s chief executive argued he acted because he believed exploitation was already under way.2 The dispute exposed the frailty of coordinated disclosure when AI can accelerate both analysis and abuse.
October 21-22: PHP released fixes early, but the web was already in emergency mode. Cloudflare saw thousands of exploit attempts before disclosure, then tens of thousands within 45 minutes, hundreds of thousands within two hours and eventually millions.3 Governments from Finland to Japan, alongside businesses and public services, took sites offline while teams patched; Britain alone suspended 32 government services as a precaution.4
The immediate threat remained contested. The PHP Foundation said it knew of no successful remote-code execution, while a reposted alert said successful exploitation had been observed on honeypot servers, with attackers fetching additional payloads.
5 Either way, the practical message was blunt: patch now, and isolate systems that cannot be fixed.
For smaller organizations, that is harder than it sounds. One cybersecurity expert argued that taking every vulnerable site offline was neither feasible nor necessary, but warned that AI-enabled attackers can move “within minutes.”6 Tools are already being marketed to help: Perplexity offered free credits for a PHP2Shell exposure check that scans sites and deployment configurations, then prioritizes fixes.7
The episode stopped short of the feared web-wide catastrophe. But it delivered a sharper lesson: AI may help defenders find the next hidden flaw first—provided they can patch faster than its details spread.