A monumental cybersecurity crisis driven by artificial intelligence is currently threatening global infrastructure, as highlighted by The Wall Street Journal. Developers behind PHP, which powers 70% of websites, announced an extreme memory flaw on Wednesday capable of granting hackers full server control.
Security experts discovered the flaw using artificial intelligence, prompting a desperate rush to deploy patches before criminals launch automated attacks.
Fearing swift exploitation, multiple organizations proactively deactivated their web properties following reports of early intrusion efforts. Dubbed PHP2Shell, the memory management vulnerability allows attackers to run illicit programs on unpatched servers almost instantaneously. Volker Dusch, an engineer at the PHP foundation, declared it the project's gravest danger in a decade, rivaling the infamous Heartbleed incident. Software updates initiate a high-stakes race where defenders install fixes while attackers reverse-engineer them to find new openings.
"Some dude on Twitter could take the patches and run AI against it and post some exploit script," cautioned Calif head Thai Duong to The Wall Street Journal. "All hell will break loose."
Calif analyst Ryan Austin exposed the hidden bugs in August using OpenAI's GPT-5.6 Sol. Long considered too complex to weaponize, the forgotten source code flaw was finally cracked by AI, requiring mere seconds to compromise smaller networks. Alerting the PHP team on August 11, Duong warned, "There's a serious issue here,"
Cybersecurity teams from Google's Wiz and OpenAI quickly joined forces with distributors to contain the threat. Despite the flood of AI-discovered bugs overwhelming developers, this specific vulnerability took absolute precedence. Wiz executive Ami Luttwak called it "the most severe AI vulnerability that was ever found," noting human researchers likely could not have detected it alone.
To prevent disaster, the coalition operated in strict confidentiality. The massive patching operation required writing 10,000 lines of code across 200 files. Following a premature leak on Hacker News, the planned October 22 release was abandoned. Authorities hastily deployed the fix on Wednesday, a move chronicled by The Wall Street Journal. Dusch explained the sudden launch offered "a good balance to inform defenders," adding it helped "and not give attackers too much time to develop exploits."
