A PHP bug that everyone had written off as harmless turned out to be a route to full control of a server, and it took one researcher with AI tools under two weeks to prove it. IEEE Spectrum's account of PHP2Shell is worth your attention because the pattern it describes, old flaws labelled 'only a crash' becoming serious when AI does the hard reasoning, applies far beyond one language. PHP still runs a large share of the web, so the sites at risk were not obscure ones.
The flaw itself is an out-of-memory error, where a piece of data is given less space than it needs. On its own that usually just crashes the program, which is why it was reported to the PHP Foundation back in 2024 and left unfixed. Earlier in 2026 the security firm Calif offered to audit PHP, with OpenAI paying for the work. In under two weeks one Calif researcher used AI tools to turn the crash into arbitrary code execution: the ability to run any code on the host. Wiz and OpenAI then confirmed the flaws and found more. The fix took four engineers two months, and the issue became public in late October 2026, with the Foundation's security release dated 21 October. As far as anyone knows, no attacks occurred before the patch shipped.
The technical point from the experts is the one that lingers. Suman Jana of Columbia describes the work of exploiting such a bug as finding exactly where in memory to jump and which bits to overwrite, in what order: not rocket science, he says, but painful, specific reasoning that AI now does well. He is careful to add that AI cannot do it alone, and that it mainly makes strong experts faster while lifting people just below that level into similar work.
This fits what we have seen elsewhere. OpenAI has run similar pipelines against the Linux kernel, and in our GPT-6 Cyber review we note the same vendor's claims about finding and exploiting flaws at scale. The common thread is that discovery and weaponisation are getting cheaper while the human work of patching does not.
That asymmetry is the catch. Jana points out that finding bugs and fixing them are not symmetric, and the gap hits unfunded open-source projects hardest. He is hopeful about formal-verification tools, such as Anthropic's 22 October release where an AI writes a patch and a checkable proof that it works. Matthew Green of Johns Hopkins is less optimistic and expects real funding only after a public disaster, which PHP2Shell was not. His practical advice, and the only defence most site owners have today, is to install security updates promptly.