AI is making it easier than ever to uncover cybersecurity vulnerabilities that have remained hidden for decades. The PHP outage brought this new reality to light this week when researchers disclosed severe flaws in the programming language that could leave an untold number of systems exposed.
Emergency patches were released, and organizations rushed to secure their infrastructure after the vulnerability was discovered – by artificial intelligence tools. In fact, the problems, which had been present for decades, could arguably only have been exploited by an exceptionally complex chain of steps not achievable by humans.
PHP Flaw: What Happened?
PHP, a widely used programming language which initially stood for ‘Personal Home Page’, dates back to the early 1990s and still underpins huge parts of the public-facing web. It is baked into WordPress, Drupal, Joomla and Magento sites, so any major vulnerability could lead to significant knock-on consequences.
Website operators scrambled to protect their systems on October 21 after the disclosure of critical vulnerabilities, with PHP developers releasing urgent new fixes that were lurking in their software for years – until AI uncovered them.
Cybersecurity teams worldwide urged PHP users to update immediately or take websites offline to be patched. Government agencies across Europe took sites offline as a precaution amid warnings from tech firms that some hackers were already exploiting the vulnerabilities.
Salesforce itself posted a security advisory on October 21, saying that it was “aware of and actively monitoring” the PHP vulnerabilities and related activity. “At this time, we have no evidence of exploitation affecting Salesforce or customer data,” the company said.
A fix is now public, and AI tools can reverse engineer it with minimal effort. Experts now warn that hackers jumped to get ahead of the updates, and we may see a wave of intrusions.
Costin Raiu, co-founder of cybersecurity research and incident response firm TLP:Black, told Reuters that AI is powering a “race to exploit,” and the next step was the “mass compromise of every vulnerable web server on the internet.”
Tiffany Farriss, Interim Chief Executive of the Drupal Association, said: “All servers using any version of PHP released in the last 20 years will be vulnerable. This issue impacts the majority of the internet.”
Dutch cybersecurity agency Censys data shows that around 1.5M out of 2.6M hosts report running a version of PHP for which there is no fix. The agency itself went offline, saying it was taking the precaution because of the vulnerabilities.
The operator of Wikipedia also said it took down an unspecified number of systems until they could be patched.
Flaw Found Using AI
The PHP vulnerability was discovered using AI, according to independent reports by two cybersecurity companies.
Calif found the issues with the help of an LLM on August 1 and has been working on a fix since then, according to a blog post.
Cybersecurity company Wiz, which is owned by Alphabet, wrote that it too had found the problem using its autonomous AI vulnerability research tool, Wiz Atlas, alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol.
The Wiz post describes PHP as a “backbone of the web,” and every PHP version released in the last decade was affected by at least one of the vulnerabilities.
“These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,” the Wiz report’s authors write.
“The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve.”
They add that frontier AI models “substantially reduced” that barrier, turning a longstanding flaw into an exploit.
Calif and Wiz revealed that they coordinated with one another and the PHP team and OpenAI on the discovery.
Final Thoughts
Frontier models are identifying and demonstrating the exploitability of flaws which have gone undetected (by humans) for decades. What does this mean for the software industry professional?
Maintainers could face a growing backlog of previously undiscovered weaknesses across the technologies which underpin the internet. That could theoretically be spun as a security benefit, but only if organizations can patch what is found before attackers turn the discoveries against them.
But the more pressing challenge is that vulnerability disclosure does not mean vulnerability resolution. Exposed systems, fragmented website ownership, and outdated software could give attackers a significant window of opportunity, even after fixes are made available.
The PHP incident might one day be remembered as an early example of a significant problem in the AI-driven cybersecurity race.
