The very foundations of the modern internet were pushed to the brink this week following the discovery of two critical vulnerabilities in PHP, the open source language that powers a vast majority of the world’s websites. Dubbed php2shell, these flaws allowed attackers to remotely execute code on unpatched systems, effectively handing hackers a master key to millions of servers. The scale of the threat was immediate and overwhelming, with Cloudflare reporting millions of exploit attempts shortly after the news broke. Some government agencies in Finland and the Netherlands took the drastic step of pulling their websites offline entirely to prevent catastrophic data breaches.
The crisis highlighted just how dependent the digital economy is on aging infrastructure. Because PHP supports everything from Wikipedia and The Guardian to WordPress, which alone drives nearly forty percent of all web pages, the potential blast radius was staggering. Cybersecurity experts noted that while some platforms like Facebook have migrated away from PHP over time, tens of millions of other instances remained vulnerable. Early victims reported devastating losses, including stolen source code and leaked legal documents, prompting urgent warnings from the FBI and NSA for organizations to patch their systems immediately.
What makes this particular breach so significant is not just its scale, but how it was found. A coalition involving OpenAI and a specialized red teaming firm called Calif utilized advanced artificial intelligence, specifically OpenAI’s GPT-5.6 Sol model, to hunt for weaknesses in PHP’s codebase. To the surprise of researchers, they uncovered a flaw that had been hiding in plain sight for fourteen years. While previous humans had spotted fragments of the issue without finding it dangerous, AI was able to connect those dots into a functional attack sequence that would have been nearly impossible for traditional audits to catch.
This revelation serves as a double edged sword for the tech industry. On one hand, AI provided a proactive shield by allowing developers to identify and fix an internet scale disaster before it could fully collapse global services. On the other hand, officials warn that these same autonomous capabilities are now available to malicious actors who can use AI to weaponize obscure bugs at lightning speed. As Greg Brockman of OpenAI noted, while this success proves AI can protect our infrastructure, it equally demonstrates that no piece of legacy code is safe when machines start doing the hacking.
