AI helped find — and may have helped exploit — a decade-old flaw in 70% of websites
Researchers used frontier AI models to uncover critical bugs buried in PHP's core code for over a decade — then hackers used similar speed to attack before the patch even shipped.
What happened: Security firm Wiz, working with OpenAI, Google DeepMind models and the PHP development team, found critical flaws buried in the core of PHP, the coding language behind WordPress, Drupal, Joomla and Wikipedia's software, powering roughly 70% of the world's websites. The bugs, nicknamed PHP2Shell, let an attacker with no login credentials take over a server, steal passwords and keys from memory, or deface a site, even when the website's own code was perfectly secure. PHP released a patch on October 21, 2026.
Why it matters: The flawed code had sat untouched in PHP for more than a decade, since version 5.4. Researchers always suspected it was theoretically exploitable, but doing so required chaining multiple obscure memory bugs and adapting to each server's exact setup, work previously considered too complex to be worth a hacker's time. Frontier AI models erased that barrier, according to Wiz, compressing what might have taken a world-class team months into about a week of work by a single researcher.
How it works, plainly: The bugs live in how PHP cleans up after certain crashes, like running out of memory mid-request. Instead of fully resetting, PHP can leave stale, corrupted data behind that a later visitor's request reuses, somewhat like a hotel room not properly cleared before the next guest checks in. That leftover data can be tricked into leaking other users' passwords and tokens, or hijacked to run an attacker's own code on the server. AI models helped find this pattern and then rewrote the attack again and again to work across different PHP versions and server setups.
The rollout: Wiz reported the bugs to PHP's team on August 24; a patch shipped October 21. But AWS says one attacker was already probing the flaw on October 17, four days before disclosure, and proof-of-concept exploit code appeared publicly within hours of the patch going live; some governments took sites offline pre-emptively. OpenAI called it among the most impactful security issues in recent memory and said similar AI-driven discoveries are expected to increase sharply, while research tracker Epoch AI says reported critical vulnerabilities have jumped from a couple dozen a month to around 600.