AI Turns Ignored PHP Bug Into Critical Threat for the Entire Web
AI tools just helped researchers weaponize a forgotten PHP bug, proving legacy code is a ticking time bomb.
Tools · Source: Hacker News
What happened
Cybersecurity firm Calif used AI tools to audit PHP, sponsored by OpenAI. They found a way to turn a known out-of-memory crash into a critical exploit. This vulnerability, dubbed PHP2Shell, allowed arbitrary code execution on host servers. It threatened major sites like Wikipedia, NASA, and the White House, along with anything running WordPress or Drupal.
The underlying bug was reported to the PHP Foundation in 2024 but ignored because it only caused a program crash. AI changed the math entirely. It automated the painful, specific reasoning required to overwrite memory bits and gain system control. Calif and OpenAI alerted the PHP Foundation before bad actors could strike.
Fixing it was a massive headache. A team of four engineers spent two months building a patch. As Columbia University professor Suman Jana notes, there is a fundamental asymmetry in security. Finding bugs with AI is getting easier. Fixing them without breaking existing features remains incredibly hard.
Key facts
- 1994 — Year the PHP programming language was created
- 2024 — Year the original out-of-memory bug was reported to the PHP Foundation
- 2 weeks — Time it took a Calif researcher using AI to weaponize the bug
- 4 — Number of engineers required to patch the vulnerability
- 2 months — Time spent developing the patch
Why it matters
If you build on legacy stacks like WordPress or Drupal, your attack surface just expanded massively. AI allows attackers just below the top tier of expertise to find and exploit memory errors that humans previously ignored. You can no longer assume a simple crash bug is harmless. Every unpatched dependency in your product is a liability. Matt Suiche from Tolmo calls this a reckoning for 40 years of human-written legacy software.
Open-source maintainers are about to get crushed by this asymmetry. They lack the funding to defend against AI-powered vulnerability discovery. We will see a push for AI-generated patches verified by formal mathematical proofs. Anthropic released a tool for this on October 22. The system uses an LLM to generate a patch and another to generate a proof of correctness. Until these automated defenses mature, the gap between attackers and defenders will widen. Johns Hopkins professor Matthew Green warns that funding will not arrive until a truly catastrophic hack happens, likely in early 2027.
For builders
Audit your legacy dependencies now
AI tools are digging through decades of old code to find complex exploits. If your startup relies on older PHP, WordPress, or Drupal versions, you are a prime target. Pay for immediate security audits or you will lose customer trust and data.
Automate your patching pipeline
Manual patching is simply too slow when AI can weaponize forgotten bugs in just two weeks. Builders must integrate automated update systems immediately. Companies that delay routine security updates will pay the ultimate price when the next zero-day drops.
Leverage formal verification tools
LLMs hallucinate, making AI-generated code patches risky to deploy blindly. Use formal verification tools to mathematically prove your fixes work without breaking existing features. Engineering teams that adopt these workflows will save months of manual testing and avoid breaking production.
My take
I have said it before and I will say it again. Technical debt always comes due. AI is just acting as the world's most ruthless debt collector. If you are building products on top of neglected open-source code, you are building a house on sand. Update your software today.
Original reporting: Hacker News. This is my rewrite and opinion.