Automation

How AI Tools Helped Uncover Years-Old PHP Vulnerabilities

Recent security disclosures highlight how advanced artificial intelligence models can help uncover and operationalize historical software flaws, putting fresh pressure on IT teams.

Radwan AbdulhadiEditor and technology writer

Published: October 24, 2026 · Updated: October 24, 2026 · 4 min read

How AI Tools Helped Uncover Years-Old PHP Vulnerabilities — Image: WIRED

Rapid Exploitation Attempts Follow PHP Flaw Disclosures

As security teams and web administrators scrambled to patch newly public PHP bugs, criminal hackers quickly attempted to exploit the flaws in the wild. Millions of exploitation attempts hit within hours of the vulnerabilities being published, according to analysis from Cloudflare. This swift reaction was unsurprising given broad access to automated tools that can make it easier for attackers to quickly target exposed systems.

Despite the high volume of initial activity, the nightmare scenario of mass victim takeovers and breaches has not materialized. The PHP Foundation noted that it has not seen any successful exploitation of the bugs, which were collectively dubbed PHP2Shell. Furthermore, many publicly circulating potential exploits appear to be ineffective against properly secured environments.

The Role of Artificial Intelligence in Uncovering Historic Bugs

Perhaps the most significant aspect of the security incident was how advanced models helped researchers uncover practical exploitations for vulnerabilities that were known about, at least in part, for years. In practice, artificial intelligence helped turn a historic vulnerability into a current industry crisis.

Researchers at the security company Calif were the first to identify the PHP2Shell vulnerabilities and create working exploits in early August. This discovery was achieved partially using frontier artificial intelligence tools as part of OpenAI’s Patch the Planet program, alongside expert human knowledge of PHP, its internal dynamics, and its weaknesses. Some of the underlying technical issues had actually been identified back in 2024 but were deemed too complex to exploit at that time.

Following Calif’s initial discovery, researchers at OpenAI and the Google-owned security firm Wiz independently discovered PHP2Shell flaws using artificial intelligence tools. Sagi Tzadik, a security researcher at Wiz, noted that the vulnerability had been known to the PHP team for years, but because it could not be easily leveraged by a human attacker, it remained unaddressed.

Expanding Capabilities and Pressure on IT Teams

No software is entirely perfect, and flaws inevitably exist in even the most critical, foundational digital tools. However, the expanding capabilities of artificial intelligence models have made it faster to analyze codebases and potentially exploit vulnerabilities. This reality puts even more pressure on under-resourced IT teams, developers, and administrators trying to keep pace with continuous security patches.

As an illustration of the growing software maintenance burden, Microsoft’s security updates included a record 1,453 security vulnerabilities during a single month. Meanwhile, Bank of America recently hired 1,000 consultants specifically to fix security flaws discovered by Anthropic’s Mythos model. Security researchers emphasize, however, that artificial intelligence is ultimately not introducing entirely new mechanics, but rather magnifying existing dynamics of vulnerability discovery and coordinated disclosure.

Evaluating the Long-Term Threat of AI-Assisted Hacking

Industry experts hold mixed views regarding whether the tech industry will face a massive wave of critical vulnerabilities that have remained dormant for decades. Jake Williams, vice president of research and development at Hunter Strategy and a former NSA hacker, stated that organizations will likely see more long-life bugs that have persisted across software versions for years. Nevertheless, he noted that there is a limited supply of low-hanging fruit with the specific global reach of PHP, given that it represents a particularly wide attack surface exposed directly to the internet by design.

Researchers also point out that even with frontier artificial intelligence models, most sophisticated AI-aided hacking examples still heavily involve expert human oversight and specialized knowledge. Ryan Austin, the Calif researcher who first discovered the PHP flaws, emphasized that no model is simply capable of unearthing all bugs with simple prompts, at least given current technological limitations.

Consequently, some security engineers suggest that organizations can dial back their extreme concerns. Niels Provos, a security engineer and researcher, expressed that he is not overly worried about artificial intelligence uncovering an overwhelming number of historic bugs that suddenly become exploitable, or discovering complex new vulnerabilities that could not have been practically uncovered without automated assistance.