AI Found a Decades Old PHP Vulnerability. Is This the Future of Cybersecurity?

PHP2Shell shows how artificial intelligence is changing vulnerability research and why defenders must prepare for a world where discovering and exploiting software flaws becomes faster.

In October 2026, two critical vulnerabilities in PHP made headlines across the cybersecurity community. Known collectively as PHP2Shell, CVE-2026–109618 and CVE-2026–109619 could allow unauthenticated attackers to execute code remotely on vulnerable servers. Both received a CVSS v4.0 severity score of 9.2. Wiz Research published its findings on October 21.

But the most interesting part of this story isn't just the vulnerabilities themselves. AI played a major role in helping researchers uncover and investigate flaws that had remained hidden for years.

This raises an important question: Are we entering an era where AI can discover security weaknesses faster than humans can?

How Did AI Help Find PHP2Shell?

PHP powers a huge portion of the web, including platforms such as WordPress, Drupal, and Joomla. Because PHP is mature and widely used, its underlying code has been examined by developers and security researchers for years.

Yet, extensive human review doesn't guarantee that every vulnerability will be found.

According to Wiz Research, the PHP2Shell investigation involved AI-assisted research tools, including models from OpenAI and Google, alongside the team's own expertise and tooling. OpenAI also reported that Calif identified a critical flaw using GPT-5.6 Sol, while Wiz independently discovered and reported both vulnerabilities.

The breakthrough wasn't simply asking an AI to scan code and point out a mistake. The challenge involved complex memory-safety problems, situations where PHP's handling of errors and internal memory state could leave invalid data behind.

Researchers used AI to help analyze code, investigate unusual behavior, develop exploit techniques, and work through repeated testing and debugging. These flaws required connecting multiple low-level behaviors into a chain that could produce a serious security impact.

In other words, AI helped make a difficult research process more practical. Human researchers still played an essential role in understanding the system, validating results, coordinating disclosure, and ensuring the problems were fixed.

Why Does This Discovery Matter?

The vulnerabilities affected PHP itself, rather than one particular website or content management system. That distinction matters, changing application code alone would not necessarily protect a server running a vulnerable PHP version.

The flaws could expose sensitive process memory or enable remote code execution, potentially giving attackers access to a compromised server and the information it handles.

More importantly, the discovery illustrates a shift in cybersecurity: AI can help turn obscure, difficult-to-exploit bugs into practical security findings.

If AI lowers the time and expertise needed to investigate complex code, vulnerabilities that once seemed too difficult to exploit may become realistic targets. The same capability can help defenders discover and fix those flaws before attackers take advantage of them.

The AI-Assisted Vulnerability Discovery Loop

A simplified version of the process looks like this:

Analyze: Examine source code and identify suspicious patterns.
Test: Generate edge cases and investigate unexpected behavior.
Trace: Follow crashes and errors to potential root causes.
Validate: Confirm whether a genuine vulnerability exists.
Fix: Work with maintainers to patch the issue and verify the solution.

AI can accelerate several of these stages, but it doesn't automatically make every result correct. Researchers must distinguish real vulnerabilities from false positives and test whether proposed fixes actually work.

What Does This Mean for the Future of Cybersecurity?

I see three major implications.

Attackers may become more capable. AI could help malicious actors analyze unfamiliar code, adapt techniques, and automate parts of their work. That doesn't mean every attacker will suddenly become an expert, but the barrier to certain tasks may fall.
Defensive security could become more proactive. Organizations may increasingly use AI-assisted code review, automated testing, and vulnerability research to find weaknesses before software reaches production.
Human expertise will evolve. Security professionals will need to understand systems, evaluate AI-generated findings, prioritize risk, and make sound decisions under pressure. Knowing how to use AI responsibly may become as important as knowing how to use traditional security tools.

The Bottom Line

PHP2Shell is a warning and an opportunity. AI can help uncover vulnerabilities that have survived years of scrutiny, but the same capabilities could also accelerate attacks.

The future of cybersecurity won't be determined by AI alone. It will depend on how quickly developers patch flaws, organizations improve their defenses, and security professionals learn to work effectively with these tools.

The real advantage won't belong to whoever uses AI first. It will belong to whoever can use it responsibly, verify its findings, and act before the other side does.