Here’s How AI Exposed Long-Hidden Web Flaws Hackers Raced To Exploit
Artificial intelligence tools helped uncover dangerous flaws in the software behind millions of websites, sparking a race to fix them as hackers rushed to strike.
Dylan Kresak · Oct 23, 2026 · 4 min read
Artificial intelligence tools helped uncover dangerous flaws in the software behind millions of websites, sparking a race to fix them as hackers rushed to strike.
The PHP Foundation fixed two serious security holes within its software Wednesday after months of delays caused, in part, by a surge of AI-generated security reports, a foundation spokesperson told the Daily Caller News Foundation. PHP, a website programming language, powers websites for governments and banks, among the many other organizations, according to a Wednesday PHP Foundation blog post.
The Cybersecurity and Infrastructure Security Agency encouraged organizations to update their websites immediately and lookout for suspicious online activity, according to a Wednesday alert.
These security flaws, called “PHP2Shell,” could let hackers remotely take over vulnerable websites, according to Wiz Research. PHP powers roughly 70 percent of websites across the globe.
Cloudflare, which handles traffic for millions of websites, saw thousands of attempts to exploit the flaws within the 10 hours leading up to their public disclosure, Cloudflare CEO Matthew Prince said on X Wednesday. That number climbed into the millions following the announcement.
‘Find Bad Vulnerabilities In PHP’
Wiz, in addition to researchers at Calif and OpenAI, identified the flaws between August and September, PHP’s blog post stated. Calif used OpenAI’s GPT-5.6 Sol to find one of the flaws, OpenAI said in its Wednesday blog post.
“Frontier AI helped us find and fix vulnerabilities that had remained hidden in the PHP codebase for more than a decade,” Wiz researchers wrote in a Wednesday blog post.
The same OpenAI model was among those involved in the July breach of AI startup Hugging Face.
AI tools buried the PHP Foundation’s small team in bug reports that contributed to months of delays for a fix, a foundation spokesperson told the Daily Caller News Foundation. There was an “ever-increasing volume of incoming security reports due to the availability of AI tools,” which was among the reasons for the holdup.