AI helped crack a decades-old PHP bug that put most of the web at risk
A years-old flaw in PHP, the code running much of the internet, became exploitable once AI tools cracked it — triggering mass patching, NSA warnings, and millions of attack attempts within hours.
What happened: In what researchers are calling 'Black October,' security teams at a firm called Calif used AI tools, partly through OpenAI's Patch the Planet program, to find a severe, long-buried bug in PHP, the coding language behind millions of websites. OpenAI and Google-owned Wiz independently found the same flaw using AI shortly after. Once the bugs, nicknamed PHP2Shell, were made public on October 21, Cloudflare recorded exploitation attempts jumping from thousands to millions within two hours. The NSA issued an alert urging immediate patching, and government and private sites in the US and UK briefly went offline to fix it.
Why it matters: Tech leaders reacted with unusual alarm. Sam Altman said he no longer believes every bug can be patched in time. Anthropic's deputy security chief warned of a coming 'vulnerability tsunami,' Salesforce's Marc Benioff called it a 'code red,' and Cloudflare's CEO predicted two years of AI tools relentlessly hunting flaws faster than defenders can respond. Some experts estimated up to 70% of websites run PHP and were technically exposed, underscoring how much of the internet rests on a handful of shared, aging foundations that nobody has fully audited in decades.
How it works, plainly: The underlying weaknesses in PHP were known for years, even flagged back in 2024, but were judged too complicated for a human attacker to actually use, so they sat unpatched. AI models changed that by working through the exceptionally complex chain of steps needed to turn a theoretical flaw into a working exploit, something researchers say was at the edge of human capability alone. Importantly, experts stress AI didn't do this unaided: it still took skilled human researchers steering the process, not a simple prompt that unearths every bug.
The rollout: Despite the panic, the PHP Foundation says it has not confirmed any successful breach, and many exploit scripts circulating online reportedly don't work. One veteran researcher said he's 'not really worried' because AI-assisted hunting has been underway for over a year and still needed a top-tier team to crack this. Others note PHP's scale is unusual; few other tools are as exposed to the open internet. Still, costs are mounting: Microsoft logged a record 1,453 security fixes this month, and Bank of America hired 1,000 consultants to patch flaws AI had surfaced.