Tech • AI • Robotics • Game
AI found the flaw threatening 70% of the Web!
7/10TL;DR
A newly publicized pair of PHP vulnerabilities exposed how AI-assisted security research can uncover long-hidden flaws at the core of software used across much of the web, while also intensifying fears of faster, more destructive cyberattacks.
KEY POINTS
Two critical PHP flaws triggered alarm
The vulnerabilities were described as pre-authentication issues, meaning attackers would not need a password to exploit them. They were rated around 9.2 out of 10 in severity and affected PHP 5.4 and later, raising concern because even well-built applications can be compromised if the underlying runtime is flawed.
The web-wide impact looked unusually large
The panic was amplified by the scale of PHP, which still powers a large share of the internet, including many WordPress sites. Because the weakness sat in the language engine itself rather than in an individual application, updating a website alone would not be enough if the vulnerable PHP layer remained in place.
AI helped find variants of old memory-corruption bugs
The flaws were linked to memory corruption issues and reportedly resembled bug families seen in earlier years, including cases dating back to 2004 and 2020. Current models are especially effective at variant analysis, scanning for new manifestations of known bug types rather than inventing entirely new classes of attack.
Human experts still made the difference
The discovery did not come from autonomous AI working alone. Researchers with prior knowledge of PHP appear to have guided the models toward promising areas, showing that expert direction remains crucial even as models become much more capable at identifying real vulnerabilities.
A credit fight broke out between security and AI firms
The vulnerabilities became the center of a public contest over who found them first and which model deserved recognition. A researcher at Calif was presented as the first to identify the issue, while Wiz later found related variants and promoted results tied to Gemini 4, turning a technical finding into a broader communications battle among major AI and cybersecurity players.
Open-source maintainers are being overwhelmed
The episode highlighted a growing bottleneck for critical open-source projects. The PHP Foundation reportedly operates on a budget of about $683,550, enough for roughly 10 full-time developers, a tiny resource base compared with the cost of elite AI security researchers and the heavy token spend required for intensive automated bug hunting.
The bug-report flood has changed character
Maintainers previously dealt with waves of low-quality, AI-generated reports filled with hallucinations. More recently, the problem has shifted: there are now far more reports that appear to be genuine, creating a new overload problem for small teams that lack the time to validate, prioritize and patch them safely.
The new challenge is patching, not just finding bugs
Security work is moving from discovery to remediation. Fixing flaws without introducing new ones, preserving system stability and avoiding a wider attack surface has become the harder task, especially when open-source maintainers have limited staff and infrastructure.
Programs like Patch the Planet are becoming more important
Initiatives such as Patch the Planet, involving OpenAI, Calif and HackerOne, aim to direct model access and compute toward high-impact open-source software. The logic is straightforward: helping maintainers secure foundational tools such as PHP can produce outsized benefits across the internet.
Defenders may not keep a lasting advantage
Although advanced bug hunting consumes expensive compute, attackers do not always need cutting-edge resources. Many real-world breaches still rely on simple weaknesses such as poor passwords or badly secured operational technology, suggesting AI will accelerate both sophisticated exploitation and low-end opportunistic attacks.
The next 6 to 18 months could be especially rough
Security specialists expect a difficult near term as AI lowers the cost of discovering and exploiting weaknesses. Over a longer horizon, they argue the same technology could produce more secure code and better defenses, but only after organizations invest far more seriously in cybersecurity than they do today.
CONCLUSION
The PHP flaws exposed a deeper shift: AI is making hidden software weaknesses easier to find, but the world still lacks the people, budgets and patching capacity to respond at the same pace. Whether that leads to a safer internet or a harsher wave of attacks will depend on how quickly defenders can scale.
Ask a question