PHP Flaw Found With AI Help Prompted Global Patching Rush, Security Firms Say

Cybersecurity firms disclosed two critical vulnerabilities in the PHP programming language that prompted emergency patching across governments, banks and media organizations around the world, with the most detailed public account of the incident emerging on October 24. The flaws, tracked together as PHP2Shell, date back more than a decade and allow an attacker to run malicious code remotely on affected servers. One of the companies involved, Wiz, a cybersecurity firm owned by Google, said the weaknesses ranked among the most severe ever found in PHP and arguably in the history of software.

By the numbers, the exposure was enormous. Wiz said the flaws stood to affect about 70 percent of all websites in the world, a figure repeated in security coverage in several countries. Reports described the total at risk as roughly 300 million sites, since PHP underpins a large share of blogs, online shops and content platforms. The vulnerabilities had existed for years without being exploitable in practice by human attackers.

How AI changed the discovery

The picture changed with artificial intelligence. The flaws were found in August with the help of frontier AI models, the most advanced systems produced by leading laboratories, and Wiz was not alone. A second security firm working with OpenAI under a coordinated effort called Patch the Planet made the same finding. That program was launched in response to concern that AI could sharply expand the capabilities of cybercriminals, and in this case the same technology was turned toward finding and closing holes before they could be abused.

The disclosure did not go entirely to plan. According to accounts of the timeline, the firms intended to release a patch quietly by the end of October, but one of them posted a short video on social media showing partial detail about how an attack could work. The video was removed quickly, but it had already spread through hacker forums, forcing an earlier public patch. The US said it was looking into government systems and speeding up mitigations.

Containment and caution

The response was fast and wide. Websites belonging to several European governments and local authorities went offline while fixes were installed. In the UK, parts of a national broadcaster's website were taken down for maintenance, and a US-based human resources company briefly went offline. Japan's prime minister, Sanae Takaichi, urged companies to apply the patch quickly. In India, banks began auditing applications for weaknesses, took some non-critical services offline and prepared backups in case sites or mobile apps went down, while government teams worked on official sites.

So far the incident has amounted to an abundance of caution rather than a confirmed wave of damage, which security specialists describe as a significant win in the new era of AI assisted attack and defense. For the cybersecurity field, the episode is a signal about where demand for skills is heading. Detection now depends on filtering enormous volumes of log data, verifying AI generated findings and coordinating disclosure across vendors and governments, so familiarity with AI based vulnerability research is moving from a niche interest to part of the core toolkit for security teams.

What to watch next

Attention now turns to how many systems remain unpatched, particularly in organizations with older custom code and small security staffs. Analysts will also track whether AI firms and researchers formalize their cooperation further, since the discovery came from a coordinated effort rather than a single vendor. The incident also puts pressure on disclosure practices, after a premature social media post shortened the window between warning and exploitation. For workers building careers in cybersecurity, the case illustrates a shift in emphasis from writing rules to judging machine output under time pressure.