OpenAI、Wiz 与 Calif 用 AI 发现影响 70% 互联网的 PHP2Shell 漏洞

Researchers at three different companies said Wednesday that they used AI to discover and address a set of critical bugs that could affect 70% of the internet.

The vulnerabilities were uncovered by teams at OpenAI, Google-owned cybersecurity company Wiz, and another cybersecurity company, Calif. The bugs, collectively called PHP2Shell, could allow attackers to execute code and read memory that could contain sensitive information, like passwords.

AI played a crucial role in Wednesday’s discovery, allowing researchers to conduct cybersecurity work across multiple apps in just hours, the companies said. The disclosure comes after advancements in AI have raised concerns from Washington to Silicon Valley about how the technology could supercharge cyberattacks.

“With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work,” Wiz researchers wrote in a blog post on Wednesday.

Researchers at Wiz used Google’s Gemini 4 Argon, Wiz Atlas and OpenAI’s GPT-5.6 Sol during the research process. The bugs were discovered in late August but were disclosed to the public on Wednesday after PHP had a fix for it.

The PHP Foundation, the organization behind the coding language PHP that is at the center of the vulnerability, has released a patch for the bugs and is urging website operators to update their systems immediately.

The flaws could allow attackers to remotely execute code, disrupt services and expose customer data, according to web infrastructure provider Cloudflare, which has been working with the PHP Foundation, Calif, OpenAI and Wiz to address the issue.

The National Security Agency in a social media post urged organizations using PHP to update their systems, or take them offline if they’re unable to do so. The disclosure prompted some government websites in Europe to go offline as companies updated their systems, according to Reuters.

Wiz researchers say the issue is on par with the Heartbleed bug from 2014, which impacted an encryption technology estimated to be used by two-thirds of the Web. Heartbleed allowed cybercriminals to access that data that should have been protected.

Like Heartbleed, the researchers at Wiz say PHP2Shell could similarly serve as a turning point in cybersecurity. While the vulnerabilities existed for years, AI made it practical to deploy them.

“The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,” Wiz researchers wrote in a blog post. “Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.”