The AI-found bug threatening 70% of the internet

On October 21, 2026 at 09:36 (UTC-4), researchers at OpenAI, Google-owned Wiz, and cybersecurity firm Calif disclosed a set of critical vulnerabilities in PHP — the programming language that powers roughly 70% of all websites on the internet. The bugs, collectively named PHP2Shell, enable unauthenticated remote code execution and memory disclosure across nearly every PHP version released in the last decade. Government websites in the Netherlands and Finland were taken offline as a precaution. The U.S. National Security Agency urged organizations to patch immediately or shut down affected systems.

What makes this story different from the endless stream of security advisories isn't the severity — it's who found it. These vulnerabilities sat dormant in PHP's core engine for over a decade, hidden behind an exploit chain so complex that human researchers considered it practically unreachable. Frontier AI models turned that theoretical flaw into a working exploit in days.

What PHP2Shell actually is

The disclosure covers two CVEs, each bundling multiple memory-safety bugs rooted in how PHP handles fatal errors during request processing:

Wiz Research rates the severity at CVSS 10 — the maximum possible score. The Chinese tech outlet QbitAI independently cites a CVSS of 9.2 for the individual bugs. Either way, these are critical.

The attack works below the application layer. A PHP site running even a trivial "Hello World" script is vulnerable if its PHP version is affected. Researchers demonstrated unauthenticated RCE on the latest container images of WordPress, Drupal, and Joomla — three platforms that collectively power a staggering share of the web. The memory disclosure primitive alone can leak passwords, authentication tokens, API keys, and TLS certificates from the PHP worker process, no code execution required.

Every PHP version since 5.4 is affected — that's over a decade of releases. Patches are available for PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. But here's the catch: PHP 8.1 and earlier versions are end-of-life and receive no patch at all. A large fraction of production PHP deployments still run 7.x or 8.0/8.1, and those systems have no official fix. The PHP Foundation's advisory is blunt: there is no complete mitigation other than upgrading.

The AI that cracked it open

The discovery timeline reads like a preview of the next decade of cybersecurity:

• August 19, 2026 (UTC): Wiz Research discovers the first PHP vulnerability using a combination of Wiz Atlas, Google Gemini 4 Argon, and OpenAI GPT-5.6 Sol.
• August 20 (UTC): Unauthenticated RCE confirmed against Drupal.
• August 21 (UTC): Unauthenticated RCE confirmed against WordPress.
• August 24 (UTC): Wiz reports the vulnerabilities to the PHP security team.
• September 21 (UTC): PHP acknowledges the reports and begins coordinated fix development.
• October 21, 2026 (UTC): Patched releases go live. Public disclosure.

Calif, a security company participating in OpenAI's Patch the Planet initiative (launched in June 2026), independently identified one of the critical flaws using GPT-5.6 Sol. Wiz's team used Gemini 4 Argon throughout — for vulnerability discovery, exploit development, attack detection, and patch validation. Raluca Ada Popa, Head of Gemini Security at Google DeepMind, called Argon's contribution "invaluable."

Wiz's researchers put the productivity shift in stark terms: "With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work."

That sentence is the entire story. The underlying bugs had existed for years. Human security researchers had every reason to look for them — PHP runs the web. But chaining four separate memory-safety primitives, adapting the exploit across different PHP versions and memory layouts, and iterating through failed attempts required specialist labor that simply didn't scale. AI compressed that timeline from months to days.

Why this matters — and why it should worry you

Wiz explicitly compares PHP2Shell to Heartbleed (2014) and Log4Shell (2021) — two of the most consequential vulnerabilities in internet history. The comparison is fair, but it misses the most important difference:

The discovery method column is where everything changes. Heartbleed and Log4Shell were found by skilled humans doing skilled human work. PHP2Shell was found by AI-assisted researchers compressing months of labor into days. The same capability that lets defenders find these bugs also lets attackers develop working exploits for vulnerabilities that were previously considered "theoretically vulnerable but practically safe."

OpenAI acknowledges this dual-use problem directly. In its coordinated disclosure post, the company writes: "It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits." The company is committing $1 billion in subsidized Daybreak access for frontline defenders — organizations with limited security resources protecting essential services. It's a meaningful gesture, but $1 billion in model credits doesn't change the fundamental asymmetry: offense is easier than defense, and AI lowers the barrier for both.

OpenAI also dropped a line that should be on every CISO's radar: "These bugs are among several significant vulnerabilities we've already found and are working to fix, and we expect similar findings to increase sharply in the coming months." In other words, PHP2Shell is not a one-off. It's the first wave of an AI-driven vulnerability discovery surge that will expose decades of accumulated technical debt in the software we all depend on.

The uncomfortable questions

The coordinated response here was exemplary — two months of secret coordination involving PHP maintainers, OpenAI, Wiz, Cloudflare, AWS, Google, Microsoft, Akamai, Fastly, and multiple government agencies including the White House's Super Intelligence Force, CISA, and ONCD. But what happens when the next critical bug is found by an actor who doesn't disclose it responsibly?

The economics have shifted. If a single researcher with AI can develop a working exploit for a decade-old vulnerability in a week, then well-resourced attackers — criminal groups, nation-states, commercial exploit vendors — can do the same at scale. The "complexity barrier" that protected millions of unpatched systems is eroding. PHP 8.1 and earlier have no patch. Those systems are now permanently exposed, and AI makes it more likely that someone will weaponize the remaining variants.

There's also a governance question. OpenAI is now effectively a first responder for global cybersecurity — coordinating with governments, funding defender access, and proposing a five-stage vulnerability response framework. That's an extraordinary amount of power for a private company, however well-intentioned. The Patch the Planet framework proposes that AI labs help decide who gets advance notice of critical vulnerabilities, how long defenders get to patch, and when to disclose. These are decisions that historically belonged to national CERTs and software maintainers.

What to watch next

• Exploit-in-the-wild detection: The first signs of active exploitation will likely appear in web application firewall logs from Cloudflare, Akamai, and Fastly. Watch for unusual multipart requests followed by PHP memory-limit errors or HTTP 500 responses.
• Unpatched PHP 8.1 and earlier: Millions of servers have no official fix. Expect third-party backports, emergency migrations, and — inevitably — compromises of systems that can't or won't upgrade.
• The next disclosure: OpenAI explicitly says more findings are coming. The question isn't whether, but which foundational software component is next. Python? Node.js? The Linux kernel?
• AI exploit arms race: As defender-side AI finds more bugs, attacker-side AI will find them too. The gap between "vulnerability exists" and "working exploit is available" is collapsing from months to days.

PHP2Shell is the first major vulnerability of the AI era — not because AI caused it, but because AI made it practically exploitable for the first time. The patch is out. If you run PHP, install it. If you can't, take the server offline. The NSA already said so.