Artificial intelligence has uncovered a potentially catastrophic security flaw in one of the internet’s most widely used technologies, setting off a scramble among cybersecurity researchers, software developers, and website operators to prevent hackers from exploiting the discovery, according to the Wall Street Journal.
The vulnerability affects PHP, a programming technology that underpins as much as 70% of the world’s websites. Researchers discovered that weaknesses in the way PHP handles computer memory could allow attackers to execute malicious code on vulnerable servers, potentially gaining control of websites, accessing sensitive information, and compromising visitors.
What makes the discovery particularly troubling is that the same AI technology used to identify the problem could also make it substantially easier for criminals to exploit it.
WSJ writes that the flaw, dubbed PHP2Shell, was uncovered in August by Ryan Austin of cybersecurity firm Calif, who used OpenAI’s GPT-5.6 Sol to examine PHP’s underlying code. Although the weaknesses had been present for years, researchers had previously considered them extraordinarily difficult to exploit. With AI assistance, however, Austin demonstrated that some servers could be compromised in seconds, while more complicated systems could be breached over several hours.
The findings prompted a coordinated effort involving PHP developers, independent security researchers, and teams from Google’s Wiz and OpenAI. The group spent weeks quietly developing fixes, ultimately modifying nearly 200 files and writing more than 10,000 lines of code.
The secrecy was intentional. Researchers feared that publicizing the vulnerability before a patch was ready would give attackers an opportunity to develop their own AI-assisted exploits.
That concern reflects a broader shift in cybersecurity. Historically, hackers needed considerable time and expertise to reverse-engineer software updates and determine which weaknesses developers were attempting to correct. Advanced AI systems can now automate much of that work, potentially allowing attackers to develop working exploits before website administrators have finished installing security updates.
Volker Dusch, a security engineer associated with the nonprofit foundation responsible for PHP, called the discovery the technology’s most serious security problem in more than a decade. He compared its significance to Heartbleed, the notorious 2014 vulnerability that forced organizations around the world to urgently secure their systems.
Wiz co-founder Ami Luttwak went further, describing PHP2Shell as an exceptionally serious AI-discovered vulnerability, suggesting that its complexity might have kept it hidden indefinitely without artificial intelligence.
The developers initially targeted October 22 for releasing the patches, but details of the upcoming security update leaked onto Hacker News on Tuesday. That prompted an accelerated rollout Wednesday, as some government and commercial website operators reportedly took systems offline as a precaution and reports of attempted attacks began circulating.
The larger concern is that artificial intelligence is fundamentally changing the economics and speed of cyberattacks. The technology is allowing security researchers to uncover vulnerabilities that might otherwise remain buried for decades, while simultaneously giving malicious actors increasingly powerful tools to exploit those same weaknesses. For organizations responsible for securing the internet, the window between discovering a vulnerability and facing a potentially widespread attack may be shrinking dramatically.