AI found the bug. Now it’s a sprint.

This week, an AI helped uncover a 14-year-old flaw sitting under most of the web. The discovery was the easy part. What happens next tells us far more about whether AI makes us safer.

Sometime in August 2026, a security researcher pointed a frontier AI model at PHP — the quiet, unglamorous language that still runs a huge share of the world's websites, from WordPress blogs to government portals. Within a week, the model helped turn a flaw that had been sitting in the code for roughly 14 years into a working, unauthenticated remote-code-execution exploit.

On October 21, the world found out. Two CVEs — CVE-2026–109618 and CVE-2026–109619, collectively nicknamed "php2shell" — were disclosed alongside emergency patches. Wiz, the security firm that independently found and reported them, called it an "AI inflection point" and estimated the affected footprint at up to 70% of the internet. Within 45 minutes of the news breaking, Cloudflare's CEO said they were already seeing tens of thousands of exploit attempts. By that evening, millions.

It's tempting to read that as a horror story about AI handing hackers the keys. I think that's the wrong lesson. The more honest — and more hopeful — takeaway is this: AI found this bug first, and it found it for the defenders. The hard part, the part we're collectively bad at, isn't finding bugs anymore. It's fixing them fast enough.

What actually happened

The php2shell flaws aren't in anyone's application code. They're in PHP's own engine — in how it handles fatal errors, particularly out-of-memory conditions, during a request. A crash can leave corrupted internal state that a later request or worker quietly reuses: a use-after-free here, a type of confusion there, a stale pointer leaking worker memory that can contain passwords, tokens, API keys, and certificates.

Because the weakness lives in PHP itself, even a "Hello World" page on an affected version could be exploited. Researchers demonstrated full takeover against the latest WordPress, Drupal, and Joomla images. Nearly every PHP release from the last decade — back to version 5.4 — is affected by at least one of the bugs. Severity reached CVSS 9.2.

Here's the part worth sitting with. These weren't new bugs. They'd been present for years, in some of the most-scrutinised open-source code on earth, examined by countless human eyes and automated fuzzers. The exploit was always theoretically possible and practically out of reach. As Wiz put it, frontier models "substantially reduced that barrier." A single researcher did in about a week what the firm estimated would previously have taken a world-class team month.

That cuts both ways, and we should be honest about it. But note who was holding the tool.

This wasn't a one-off

php2shell grabbed the headlines, but it's a symptom of something structural, not a freak event.

• OpenAI ran the PHP work through its "Patch the Planet" initiative, where the red-teaming firm Calif used GPT-5.6 Sol to probe high-impact infrastructure. OpenAI's own framing is the line everyone should internalise: "discovery alone does not protect users."

• Wiz independently found the same flaws using a combination of its own tooling, Google's Gemini 4 Argon, and GPT-5.6 Sol — crediting the AI with "an invaluable contribution" not just to discovery but to exploit development, attack detection, and validating the patch.

• Google's Big Sleep agent has been on this road since 2024, when it found the first real-world vulnerability (in SQLite) that fuzzing had missed. In 2025 it flagged a flaw that was "only known to threat actors," and reported its first 20 bugs in projects like FFmpeg and ImageMagick.

• Anthropic's scanning program tells the whole story in one brutal pair of numbers: Claude surfaced roughly 29,000 candidate vulnerabilities across widely used open-source projects — and so far only about 516 have been patched upstream.

Zoom out and the trend is measurable. Analysts at Epoch AI estimate critical vulnerability reports have climbed from a couple of dozen a month a few years ago to around 600 a month today. The machines didn't make software buggier. They made the bugs findable.

The real race isn't AI vs. humans

The reflex headline is "AI-powered hackers." But look at the actual sequence of events in php2shell and a different picture emerges.

Defenders got there first. The flaw was found under a coordinated-disclosure process. PHP's maintainers were told privately in late August, acknowledged it in September, and shipped patches on October 21 — the same day the public learned anything. That gap is what OpenAI calls the "Defender's Window": the head start defenders get before a bug goes public.

The problem is that the window is closing on its own. Once a fix ships, the patch itself is a map. Anyone can diff the source, see exactly what changed, and reverse-engineer the exploit. With php2shell, there's evidence the clock was reset early — AWS reported exploitation attempts in the days before disclosure, suggesting a leak, and a single social-media post reportedly collapsed the coordinated timeline. Palo Alto Networks' first pass counted some 22.6 million potentially exposed instances.

So, the contest was never AI against people. It was the speed of patching against the speed of weaponisation — and AI compresses both sides. The question for every organisation this week wasn't "can AI find our bugs?" It was "once a critical patch drops, how many hours until we've actually deployed it?"

The bottleneck moved

Return to Anthropic's numbers, because they're the clearest signal in the whole story: ~29,000 found, ~516 fixed.

That gap is not an AI failure. It's the exact opposite — it's what success looks like when one half of the pipeline gets a superpower and the other half doesn't. Finding vulnerabilities used to be the scarce, expensive, PhD-level skill. We just made it cheap and scalable. Validating, prioritising, patching, and deploying fixes is still slow, manual, human work — often resting on a handful of volunteer maintainers and a long tail of downstream distributions that may not have an update ready on release day.

OpenAI's president Greg Brockman described the PHP fix process as "slow and manual" and warned it won't scale as findings multiply. That's the uncomfortable, unavoidable headline: we have industrialised the discovery of problems without industrialising their repair.

Why this is still good news

I want to be clear-eyed, not Pollyanna-ish — but the balance here genuinely tilts positive, and it's worth saying so plainly.

For the first time, defenders can audit code at the same scale attackers will. A 14-year-old latent RCE under most of the web is not a bug AI created; it's a bug that was always there, quietly exploitable by a well-resourced adversary who never announced themselves. AI dragged it into the light while the people holding the tools were the ones who wanted it fixed. The patch landed the day the public learned the flaw existed. That's not a failure of the system. That's roughly the best-case version of a very bad situation — and it only happened because AI compressed months of expert work into a week, on the right side of the fence.

The pessimistic read assumes attackers have a monopoly on this capability. They don't. The same models are in defenders' hands first and increasingly woven into the disclosure process itself — down to using AI to verify the fix.

What we should do about it

If discovery is now cheap and repair is the bottleneck, then the work — and the investment — must move to the repair side:

1. Fund the maintainers. The volunteers patching the backbone of the internet are now absorbing an AI-scale flood of findings on a human-scale budget. That is the single most leveraged place to spend money in security right now.

2. Keep humans in the loop — on both ends. AI-assisted discovery still produces "slop": plausible-looking reports that turn out to be hallucinations. Every serious program here pairs the model with human validation before a maintainer's time is spent. Don't drown the fixers in unverified noise.

3. Know what you run. You can't patch what you can't see. A queryable, real-time inventory of your own software — and a pre-built emergency patch path with rebuildable images — is the difference between patching in hours and patching in weeks.

4. Triage ruthlessly. Not every finding is a php2shell. A public, automatable, unauthenticated RCE under active exploitation does not wait for the next maintenance window. Most things can. Knowing the difference is the skill now.

5. Assume the window is short. Treat every critical patch as a published exploit map. Plan your deployment speed around the reality that a leak or a reverse-engineered diff can erase your head start in hours.

The bottom line

php2shell will be remembered as the week AI's role in security stopped being a demo and became operational. The instinct to panic is understandable, but it points at the wrong target. AI didn't put the bug in PHP — it found a flaw that had been hiding for 14 years, and it found it for the people trying to defend the web.

The lesson isn't "AI is dangerous" or "AI will save us." It's narrower and more useful than: finding problems is now the solved part. Fixing them is the race. The organisations and communities that win the next few years won't be the ones with the fanciest bug-hunting AI. They'll be the ones who invested, unglamorously, in shipping the fix before the window closes.

AI found the bug. Now it's on us to win the next part.

Sources

• Wiz Research — PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet

• Fortune — AI helped discover the PHP vulnerability… now the race is on to patch it

• Axios — OpenAI model uncovered massive flaw in web's foundational code

• Mother Jones — AI Helped Find a Critical Bug Affecting Huge Swathes of the Internet

• The New Stack — Claude found 29,000 possible bugs in open source. Only 516 have been fixed.

• Safeguard — Patch the Planet: What AI-Found Bugs Mean for Disclosure and Defenders

• The Record / SecurityWeek — background on Google's Big Sleep AI agent (2024–2025)

Note on attribution: reporting on exactly which firm and which model found php2shell first is still being reconciled across outlets (OpenAI's "Patch the Planet"/Calif and Wiz both feature). Figures like "70% of the internet" and the 22.6M exposure count are each from single sources — worth a line of caveat if you want to be bulletproof. The core facts — the CVEs, the coordinated patch on Oct 21, and the discovery-vs-repair gap — are well supported.