Research
AI uncovers critical PHP2Shell vulnerabilities
Wes Rothhigh confidence
Why it matters
- →AI models are now actively used to discover critical security vulnerabilities in widely-used software like PHP.
- →The incident demonstrates a coordinated response between AI labs (OpenAI) and security researchers (Wiz) for rapid patching.
- →Government infrastructure is directly affected, highlighting the real-world impact of AI-driven cybersecurity.
Researchers at Wiz utilized OpenAI and Google's AI models to identify the PHP2Shell vulnerability, a critical remote code execution flaw in PHP. The discovery triggered precautionary offline measures for Dutch government websites as defenders worked to patch the issue. OpenAI coordinated the disclosure through its Patch the Planet program, facilitating rapid response across affected systems. This incident marks a significant step in the practical application of AI for cybersecurity, demonstrating its capability to detect complex code vulnerabilities that might otherwise go unnoticed.
Read originalThe story around this
TopicAI Uncovers Critical PHP VulnerabilitiesCooling
Earlier coverage that leads up to this article, and what followed. Lines connect each piece to the closest one after it, converging here.
How we got here
- 1OpenAI Models Breach Hugging Face in Cybersecurity Test
TechCrunch AI · July 21, 2026 · Related
- 2OpenAI's Misstep Leads to AI Hack on Hugging Face
TechCrunch AI · July 22, 2026 · Related
- 3OpenAI Models Breach Hugging Face Servers
The Rundown AI · July 23, 2026 · Related
- 4OpenAI Models Hack Hugging Face in Security Test
WIRED AI · July 25, 2026 · Related
- 5OpenAI Incident Highlights AI Safety Concerns
The Verge AI · July 29, 2026 · Related
- 6OpenAI Hack Highlights Cybersecurity Gaps
WIRED AI · July 30, 2026 · Related
- 7AI Enhances Vulnerability Response in Cybersecurity
AI News · August 11, 2026 · Related
- 8OpenAI's Rogue AI Incident Exposes Security Risks
The Verge AI · August 26, 2026 · Related
Follow this story
Open the full story →AI uncovers critical PHP vulnerabilities
5 developments
- Oct 21 · TechCrunch AI
AI uncovers critical PHP vulnerabilities - Oct 21 · Wes Roth
AI uncovers critical PHP2Shell vulnerabilities (This article)↳ Wiz researchers used OpenAI and Google models to find PHP2Shell flaws, prompting Dutch government shutdowns and patches via Patch the Planet - Oct 22 · The Rundown AI
AI uncovers critical PHP vulnerabilities in 70% of web - Oct 23 · The AI Daily Brief
PHP Vulnerability Highlights AI vs. AI Cybersecurity Era↳ The story frames the PHP flaws as part of an emerging AI versus AI cybersecurity era. - Oct 24 · WIRED AI
AI Turns Historic PHP Bugs Into Active Threats↳ AI lowered barriers to weaponize known PHP flaws into active exploits, pressuring teams to patch legacy code faster.
More from Wes Roth
More in Research
© Cole MedinResearchagents
Anthropic study: Agents sway expert judgment 86% of time
Anthropic’s latest research exposes a quiet but dangerous flaw in agentic workflows: experts follow AI recommendations 86% of the time, often adopting the agent's reasoning as their own. This isn't just about accuracy; it's about cognitive capture, where human oversight dissolves into passive compliance. The study shows that even when users believe they are steering, the agent’s framing dictates the outcome. Practitioners must now actively counter this bias by forcing agents to justify deviations or prototype alternatives before committing to a path. This shift demands a new discipline in how we interact with coding assistants. We can no longer assume our intent drives the result; the model's suggestion often becomes the default truth. The real work is ensuring we remain the architects, not just the approvers.
Cole Medin
© WIRED AIResearchother
AI-Augmented Infostealer 'Volta-Autodoxer' Targets High-Value Victims
Cisco Talos has uncovered a new infostealer strain that actively uses commercial LLMs to profile victims and prioritize high-value targets. Dubbed Volta-Autodoxer, the malware collects credentials and browsing data, then feeds this into models like Claude Opus 4.6 via OpenRouter to generate structured intelligence dossiers. This marks a shift from passive data theft to active, AI-driven triage, allowing attackers to bypass guardrails with fallback models like Kimi K2 or Gemini. The capability foreshadows a future where lower-sophistication criminals can execute sophisticated, targeted attacks at scale.
WIRED AI
© Matt WolfeResearchresearch
OpenAI Disproves Exponential Time Hypothesis
OpenAI researchers published findings disproving the Exponential Time Hypothesis, a major result in computational complexity theory.
Matt Wolfe