OpenAI, Wiz and Calif use AI to discover PHP2Shell vulnerabilities affecting 70% of the internet
Research teams from OpenAI, Wiz and Calif used AI to discover and address a set of critical vulnerabilities named PHP2Shell, which they say could affect 70% of the internet. The research used Google's Gemini 4 Argon, Wiz Atlas and OpenAI's GPT-5.6 Sol; the vulnerabilities were discovered at the end of August and made public on Wednesday after the PHP Foundation released patches. Wiz researchers said that with frontier AI models and the right tools, a single researcher completed in one week work that previously took world-class teams months, and compared the issue to Heartbleed in 2014.
Why read this
SelectedAI score 84
Wiz says a single researcher completed in one week work that previously took world-class teams months, and the issue can be understood by comparison to Heartbleed in terms of AI's place in vulnerability discovery.
Topics
Body
Researchers at three different companies said Wednesday that they used AI to discover and address a set of critical bugs that could affect 70% of the internet.
The vulnerabilities were uncovered by teams at OpenAI, Google-owned cybersecurity company Wiz, and another cybersecurity company, Calif. The bugs, collectively called PHP2Shell, could allow attackers to execute code and read memory that could contain sensitive information, like passwords.
AI played a crucial role in Wednesday’s discovery, allowing researchers to conduct cybersecurity work across multiple apps in just hours, the companies said. The disclosure comes after advancements in AI have raised concerns from Washington to Silicon Valley about how the technology could supercharge cyberattacks.
“With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work,” Wiz researchers wrote in a blog post on Wednesday.
Researchers at Wiz used Google’s Gemini 4 Argon, Wiz Atlas and OpenAI’s GPT-5.6 Sol during the research process. The bugs were discovered in late August but were disclosed to the public on Wednesday after PHP had a fix for it.
The PHP Foundation, the organization behind the coding language PHP that is at the center of the vulnerability, has released a patch for the bugs and is urging website operators to update their systems immediately.
The flaws could allow attackers to remotely execute code, disrupt services and expose customer data, according to web infrastructure provider Cloudflare, which has been working with the PHP Foundation, Calif, OpenAI and Wiz to address the issue.
The National Security Agency in a social media post urged organizations using PHP to update their systems, or take them offline if they’re unable to do so. The disclosure prompted some government websites in Europe to go offline as companies updated their systems, according to Reuters.
Wiz researchers say the issue is on par with the Heartbleed bug from 2014, which impacted an encryption technology estimated to be used by two-thirds of the Web. Heartbleed allowed cybercriminals to access that data that should have been protected.
Like Heartbleed, the researchers at Wiz say PHP2Shell could similarly serve as a turning point in cybersecurity. While the vulnerabilities existed for years, AI made it practical to deploy them.
“The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,” Wiz researchers wrote in a blog post. “Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.”