In early August 2026, Sagi Tzadik, a security researcher at cybersecurity firm Wiz, asked an artificial intelligence agent to check whether a security flaw found in WordPress could be applied to the Drupal platform. Eight hours later, the agent reported that the test had failed, but at the same time it had discovered a bug in the PHP programming language, the language on which both WordPress and Drupal depend and which is used by up to 70% of the web’s content.
Tzadik initially thought the AI was mistaken—„Models tend to hallucinate,“ he told TIME magazine. But it turned out that the exploit, which took advantage of a decades-old PHP vulnerability, actually worked. The flaw had gone unnoticed for more than a decade before the AI exposed it. At the same time, a team of other researchers from cybersecurity firm Calif., working with OpenAI, also used AI to find a related vulnerability. This suggests that as AI reaches a certain level of proficiency, old, long-undetected vulnerabilities become visible.
AI as a defense tool and its limits
AI companies are working to give defense specialists like Wiz and Calif early access to the latest models so they can find loopholes before malicious users can exploit them. This time, they succeeded – AI helped discover a PHP vulnerability before it was widely distributed. This situation reveals a new era in cybersecurity, where AI quickly identifies vulnerabilities, while also reducing the time it takes to fix them.
Rapid response and challenges
Although the vulnerability disclosure raised concerns about a possible „cyber apocalypse“ scenario, the researchers remained optimistic. „We are patching vulnerabilities at an incredible rate, and that is improving security overall,“ Tzadik said. But the facts show how close the disaster was: information about the flaw began to spread online two days before the planned release of the patch, which forced PHP maintainers to speed up the release of the patch. The patch was released a day ahead of schedule.
After the patch was not yet available, Calif accidentally posted a video showing their exploit in action. This led to numerous copycat attempts — Cloudflare recorded thousands of attempts before the official announcement, tens of thousands within 45 minutes, hundreds of thousands within two hours, and eventually millions. Even after the patch was released, some websites, including government sites and Wikipedia, were temporarily taken down as a precaution while security teams implemented the update.
Cooperation and trust
The patching process was an informal sprint: After Calif and Wiz reported the PHP vulnerability, the two companies teamed up. While there was no formal agreement between them, the researchers shared information through common channels, and the process was „based solely on trust,“ according to Tomer Schwartz, Wiz’s CTO. The group of about 15 people communicated almost daily to identify the common source of the vulnerability and develop a patch.
OpenAI said the PHP bugs are just a few of „a number of significant vulnerabilities we’ve already found and are fixing,“ and predicts similar discoveries will increase eightfold in the near future. This raises the question of updating processes, methods, and technologies to keep pace with cyberattackers.
AI speeds up research, but doesn't eliminate labor intensity
AI allows researchers to test multiple hypotheses at once, and traditional research that used to take weeks is now compressed into days or even hours. But even with the help of AI, the explanation for the vulnerability remained unclear—the agent provided only „vague“ descriptions, so Tzadik and colleagues spent days trying to figure out the cause and finally reproduce the bug. There’s also the issue of cost: research costs and resource requirements remain significant even with AI.
Conclusions
This PHP security flaw shows how AI can become a powerful tool in cybersecurity, but it also reveals that speed and collaboration are essential to avoid potential disasters. While AI helps uncover old weaknesses, it is necessary to constantly update processes and invest in rapid response to prevent malicious users from exploiting these vulnerabilities.
—
Crikis IT – specialists who help companies implement AI and automation solutions in the field of cybersecurity.
