In late October, researchers discovered the PHP2Shell vulnerability, a critical flaw in PHP that put major websites including NASA, Wikipedia, and the White House at risk. The vulnerability was discovered and patched before exploitation, but it revealed a broader problem: AI tools are rapidly exposing security flaws in legacy software written over the past 40 years.
The underlying bug was an out-of-memory error in PHP, a programming language created in 1994. Such errors typically cause programs to crash and were reported to the PHP Foundation as far back as 2024. Because they appeared minor, they remained unfixed.
Earlier this year, the cybersecurity firm Calif, sponsored by OpenAI, audited PHP independently. Within two weeks, a researcher at Calif using AI tools discovered how to exploit the memory error to run arbitrary code on servers—transforming a minor bug into a critical vulnerability. The team immediately alerted the PHP Foundation, which took two months to develop and release a patch.
According to Suman Jana, an associate professor of computer science at Columbia University, the vulnerability required “very specific reasoning that is painful to do,” but AI has “done a very good job at that.” However, Jana emphasized that AI alone cannot find such vulnerabilities; instead, it amplifies the capabilities of top cybersecurity experts and makes advanced techniques accessible to those without deep expertise.
The discovery highlights a fundamental asymmetry in cybersecurity. Finding bugs is becoming easier with AI, but fixing them remains labor-intensive. Developers must identify all attack vectors and ensure patches don’t break existing functionality. This burden falls heavily on maintainers of open-source projects like PHP, which lack clear revenue streams despite widespread use.
Jana advocates for frontier AI labs to donate computational resources to security research and for formal verification tools to automate patching. Anthropic recently released a tool that uses AI to generate patches and proofs of correctness, with formal proof checkers validating the work.
Matthew Green, at Johns Hopkins University, takes a darker view. He argues that without a catastrophic incident affecting ordinary users—which he predicts could occur in early 2027—insufficient action will follow. For now, Green recommends users apply security updates immediately when prompted.
The vulnerability underscores that PHP2Shell is unlikely to be the last such discovery. As AI tools continue improving, defenders must keep pace.
Key facts
- The PHP2Shell vulnerability exposed major websites including NASA, Wikipedia, and the White House to potential code execution and data theft
- An out-of-memory bug in PHP, reported in 2024, was transformed into a critical vulnerability by researchers using AI tools within two weeks of auditing
- AI tools are making it easier to find exploits in legacy software, but fixing vulnerabilities remains labor-intensive and asymmetrically difficult
- Open-source maintainers face mounting pressure as AI accelerates vulnerability discovery without corresponding increases in patching resources
- Formal verification tools like those from Anthropic are advancing to automate patch generation and validation