Will AI expose the rickety infrastructure of the internet?

Earlier this week, security teams at OpenAI and Wiz (recently acquired by Google) announced a critical vulnerability in PHP that has lingered for years unnoticed. Human researchers leveraged LLM‑assisted tooling to locate the bug, then released a patch while urging site owners to apply it immediately or shut down their services. The advisory warned that the flaw could be weaponized through a PHP2Shell exploit, and cloud‑security provider Cloudflare’s CEO Matthew Prince confirmed a surge of millions of attack attempts within hours of the disclosure. Amazon’s security blog added that its honeypot network had already logged exploitation traffic before the public notice, underscoring how quickly threat actors can act once a weakness is known. Because PHP underpins roughly 70 % of the web—powering WordPress, Drupal and countless custom CMSs—the issue affects tens of millions of domains, many of which lack dedicated security staff to roll out patches swiftly.

The episode illustrates a broader shift where AI‑augmented tooling accelerates vulnerability discovery across the open‑source stack. Companies such as Google, OpenAI and Wiz are now fielding “Hack the Planet” style programs that pair human expertise with generative models to scan legacy codebases, effectively turning LLMs into force multipliers for bug hunting. At the same time, the same technology lowers the barrier for malicious actors to automate exploit development, eroding the traditional advantage of “security through obscurity.” This dynamic forces a reevaluation of how the internet’s foundational layers—largely built on community‑maintained projects—are protected, especially as the ecosystem increasingly relies on rapid, automated patch distribution to keep pace with AI‑driven threat hunting.

Looking ahead, the PHP incident will likely trigger a wave of AI‑assisted audits of other entrenched languages and frameworks, prompting vendors to adopt stricter disclosure protocols and perhaps embed AI defenses directly into runtime environments. Smaller sites that cannot afford immediate updates may opt to go dark, risking widespread link rot and loss of digital heritage. Organizations should prioritize automated update pipelines, invest in threat‑intelligence feeds that surface AI‑generated exploits, and consider redundancy strategies that mitigate downtime when core components like PHP are compromised.