Summary
- Security researchers leveraged AI tooling to identify critical, long-standing vulnerabilities in the PHP web scripting language.
- The same AI-assisted techniques that aided discovery also lowered the bar for attackers to weaponise the flaws.
- Two critical bugs in PHP were found to have existed for years before being surfaced through AI-augmented research.
- The incident illustrates a dual-use risk: AI accelerates both defensive vulnerability research and offensive exploitation.
- Organisations running PHP-based web infrastructure should treat this as a prompt to review patch status and exposure.
What happened
Security researchers used AI tools to dig through the PHP web scripting language’s codebase and surface vulnerabilities that had gone undetected for years. According to reporting by WIRED Security, corroborated by TechCrunch, two critical bugs were identified through this AI-assisted process. What followed was notable not just for the discovery itself, but for what came next: AI-assisted attacks on the same vulnerabilities began shortly after.
Old code, new exposure
The vulnerabilities were not freshly introduced flaws. They had been present in PHP for years, quietly waiting in code that underpins a significant portion of the world’s web infrastructure. The fact that AI tooling was required to surface them suggests they may have persisted precisely because traditional manual review and automated scanning had not flagged them. That is a sobering data point for any organisation that relies on periodic security assessments to maintain confidence in its web stack.
The dual-use problem crystallises
This incident puts a concrete face on something the security community has debated largely in the abstract: AI is not a tool that sits exclusively in defenders’ hands. The same capabilities that allow a researcher to rapidly analyse large codebases, identify patterns consistent with vulnerabilities, and prototype proof-of-concept code are available to anyone with access to the relevant models. Once a vulnerability is known, the gap between discovery and working exploit has historically been the limiting factor for many threat actors. AI compresses that gap materially.
Scale of potential impact
PHP remains one of the most widely deployed server-side scripting languages on the web. TechCrunch’s coverage framed the situation in terms of how close the two bugs came to causing widespread disruption — characterising it as a scenario that ‘almost broke the internet.’ The sources do not specify the precise attack vectors or which PHP versions are affected beyond the context of the reporting, so organisations should consult the official PHP security advisories for version-specific detail.
AI as a force multiplier for threat actors
For CISOs, the more durable lesson here is not specific to PHP. It is about the changing economics of vulnerability exploitation. Historically, the window between a vulnerability being discovered by researchers and it being reliably exploited in the wild has provided organisations some breathing room to patch. AI tools can accelerate that timeline on the attacker side, which means the patch management discipline that was previously adequate may no longer be sufficient. Rapid detection, prioritisation, and deployment of fixes will need to be tighter.
Not just a PHP story
Any mature, widely-used codebase — open source or proprietary — likely contains vulnerabilities that conventional tooling has not yet found. As AI-assisted code analysis becomes more accessible and more capable, organisations should expect a period of elevated discovery across the software ecosystem. Some of those discoveries will be made by researchers acting responsibly. Others will not. The question for security teams is whether their patching and response cadence can keep pace with both.
Why it matters
PHP powers a large share of web infrastructure globally. Two critical, long-standing vulnerabilities surfaced through AI-assisted research — and AI-assisted exploitation followed quickly. For CISOs, this is a direct signal that the defender’s advantage of time between discovery and exploitation is shrinking. Organisations with PHP in their stack need to assess patch status now. More broadly, security programmes should be pressure-testing their ability to respond rapidly, because AI is shortening the window across the vulnerability lifecycle, not just in PHP.
What to do now
- Review the patch and version status of all PHP deployments in your environment against current official PHP security advisories.
- Assess whether your vulnerability management programme can support a faster patch cadence, given that AI tools may compress the time between vulnerability disclosure and active exploitation.
- Evaluate your use of AI-assisted code analysis tools defensively — if researchers can find years-old bugs this way, your own teams should be applying similar techniques to proprietary and open-source dependencies.
- Ensure web-facing PHP applications are covered by runtime monitoring and web application firewall rules that can detect exploitation attempts while patching is underway.
- Revisit the assumption that legacy, stable codebases are lower risk simply because they have not recently changed — AI tooling is surfacing vulnerabilities that conventional review missed for years.
