Story
Oct 28, 2026

AI Found PHP’s Web-Wide Flaw, but the Patch Race Is Only Beginning

The PHP2Shell scare offered a rare win for AI-assisted defense: researchers found and patched a long-hidden flaw before it spiraled into mass compromise. But governments, small businesses and security leaders drew the same harder lesson—when AI speeds discovery for everyone, patching and resilience become the real line of defense.

In August, researchers at Wiz and Calif used advanced AI models to uncover related vulnerabilities buried for more than a decade in PHP, the language estimated to underpin roughly 70% of the web. The discovery was encouraging for defenders, but it also revealed the new asymmetry: AI can compress months of vulnerability research into hours, while attackers need only find one organization that is late to act. “We are fixing vulnerabilities at an unprecedented rate,” Wiz researcher Sagi Tzadik said, even as his colleagues warned that defenders must cover every flaw.

The race tightened when details leaked ahead of the planned patch release. Exploit attempts rose from thousands before disclosure to millions afterward, according to Cloudflare. A post relayed by Aravind Srinivas said exploitation had been confirmed on honeypot servers, with attackers using shell commands to retrieve additional payloads.

By Wednesday and Thursday, the defensive response was visible to ordinary users. Governments and companies from Finland to Japan took services offline while applying the PHP Foundation’s update; Britain alone shuttered 32 government services as a precaution. For well-resourced institutions, the outage was a manageable “speed bump.” For smaller firms, it could mean hours offline—and a reminder that a server-level breach can expose data, alter sites or become a route into wider networks.

Security teams’ immediate prescription was blunt: identify exposed systems, patch PHP itself rather than merely updating WordPress or plug-ins, and take systems offline when evidence suggests targeting. OpenAI co-founder Greg Brockman’s call for teams to focus on assessing exposure and applying fixes captured the industry’s shift from abstract AI debate to operational triage.

The immediate catastrophe has not fully materialized. Researchers say the bugs proved harder to exploit reliably than the torrent of attack attempts suggested, and rapid defense work helped. That is a reprieve, not a verdict on the threat. As Armadin’s Samantha Lewis put it, the next major disclosure could arrive not years from now, but “three hours from now.”

Story coverage