An AI-assisted security audit of PHP has demonstrated how quickly an apparently routine software crash can become a critical vulnerability, renewing concern that artificial intelligence may accelerate vulnerability discovery faster than maintainers can produce safe patches. The flaw, dubbed PHP2Shell, affected a language used across major content-management systems and a vast number of websites.
According to IEEE Spectrum, the underlying out-of-memory bug had been reported to the PHP Foundation in 2024. Such bugs often cause a program to stop but are not automatically treated as exploitable. During an audit sponsored by OpenAI, security firm Calif used AI tools while examining PHP and found a method to turn the bug into arbitrary code execution. That could allow an attacker to run malicious software or access sensitive data on a server.
The researchers privately disclosed the exploit, and the PHP Foundation released a patch before known malicious exploitation. Security company Wiz also confirmed and expanded the findings. The successful research required deep expertise in cybersecurity and PHP; the reported role of AI was to help experts carry out detailed reasoning and manipulation that would otherwise consume more time.
That division of labor is central to the wider concern. AI does not need to discover and weaponize flaws autonomously to change security economics. If highly skilled researchers can inspect old code and test complex exploit paths much faster, defenders inherit a larger queue of urgent work. Attackers may receive the same productivity gains, while maintainers must ensure that each fix closes every path without breaking existing software.
PHP illustrates the structural pressure. It was created in the 1990s and remains foundational to widely deployed web systems, but like many open-source projects, its maintenance resources do not necessarily match its importance. Four engineers reportedly spent two months developing the PHP2Shell patch. Finding a working exploit and shipping a reliable correction are asymmetric tasks: a single successful attack path is enough for discovery, while a patch has to preserve compatibility and cover the full vulnerability.
Researchers cited by IEEE Spectrum proposed greater funding and access to advanced cybersecurity models for defenders. They also pointed to formal verification as a possible way to automate parts of patch creation. In one approach, language models generate a repair and a proof, while a separate formal checker verifies that proof rather than trusting the model’s output.
The episode did not produce the mass compromise the vulnerability could have enabled, but it provides a concrete warning. Decades of technical debt are becoming easier to probe, and the institutions responsible for widely used software need resources to audit, patch and distribute updates at comparable speed. For users and administrators, the immediate lesson remains straightforward: apply security updates promptly once maintainers release them.
