AI Agents Discovered a Decade-Old PHP Flaw That Posed a Major Web Security Risk

Cybersecurity researchers patched a critical PHP vulnerability in August after AI agents discovered the flaw, which had gone undetected for over a decade and affected up to 70% of the web. The patch was rushed after details leaked online, triggering millions of attempted exploits. Researchers at Wiz and Calif, working with OpenAI, independently used AI to find related flaws in PHP, the programming language powering WordPress and Drupal. The groups joined forces, sharing findings informally to trace the bugs to a common source and devise a fix before the scheduled release. The episode highlights AI's dual role in cybersecurity, helping defenders find vulnerabilities faster while compressing patch timelines. Experts warn that similar discoveries will increase sharply, requiring new processes to keep pace with attackers who only need to succeed once.