AI spent an entire year hunting for vulnerabilities everywhere, and finally dropped a huge bombshell for humanity.

On the night of October 21, if you are used to browsing social media, you might have noticed a strange wave of website shutdowns: almost at the same time, various critical infrastructure websites across multiple countries and regions around the world announced temporary closures one after another.

Wednesday. The Finnish government shut down all its external online services; the Finnish National Cyber Security Center even took its own official website offline, followed by the Port of Rotterdam, the Royal Dutch Football Association, the websites of five major political parties, and multiple hospitals; the French Ministry of the Interior ordered all provincial government websites to go offline temporarily, the German federal IT service provider shut down multiple sites, and the Belgian Ministry of Foreign Affairs, the Wikimedia Foundation, and Nintendo also successively suspended some of their services.

The Dutch government announced the preventive shutdown of websites including DigiD | Image source: Rijksoverheid

But none of these websites were actually hacked, they shut down on their own initiative.

The reason lies in two vulnerabilities in PHP: PHP is the most widely used website backend language in the world. According to statistics from W3Techs, about 70% of websites whose backend language can be identified run on it. These two vulnerabilities are collectively called PHP2Shell, which allows attackers to remotely control the entire server without logging in.

The first to discover them was AI.

It is no longer news that AI has found vulnerabilities. But according to current public reports, this is the first time that a vulnerability dug out by AI has prompted governments of several countries to shut down their websites on the same day. It truly marks the end of an unwritten rule that has never been included in cybersecurity textbooks but has always worked: many vulnerabilities are only safe because attacking them is too much of a hassle.

The PHP official rated the severity of both vulnerabilities at 9.2 (out of 10), and security firm watchTowr directly gave them a full score.

Both of them exist in the lowest-level memory management of PHP, and have nothing to do with the quality of the website's own code. According to the PHP official, all PHP instances that process web requests are affected; Cloudflare said that the affected versions date back more than a decade to PHP 5.4. Volker Dusch from the PHP Foundation compared it to the "Heartbleed" bug in 2014, saying it is the most serious PHP security problem in more than a decade.

What made governments nervous was the ensuing chaotic 48 hours: the vulnerabilities were originally under the embargo period. According to industry practice, the software vendor would prepare the patch first, and then disclose it together with the discoverer.

But on October 20, someone released the news on Hacker News and the underground forum BreachForums, and watchTowr confirmed the vulnerabilities were real the same day. That night, the PHP official urgently announced that the patch would be released one day in advance, at 14:00 (UTC) on the 21st.

Before the patch was released, attack attempts had already begun. Dane Knecht, CTO of Cloudflare, said on X nearly six hours before the patch was released, "We are seeing early attacks emerging." The recommendations given by the U.S. National Security Agency, the UK National Cyber Security Centre, and EU cybersecurity agency CERT-EU are almost identical: take systems that are too late to be patched offline first.

That led to the scene at the beginning.

Three companies jointly disclosed this set of vulnerabilities | Image source: PHP2Shell

The Resurrection of Ghost Vulnerabilities

PHP2Shell is most unusual in that it is not new, it wasn't even discovered just yesterday.

In the technical article, Calif, the first security company to discover it, traced its origin back to 2004. 20 years ago, security researcher Stefan Esser found a similar problem in PHP when memory was exhausted. In 2020, someone submitted a related bug report, which was almost ignored; in 2024, a PHP security audit funded by a third party also encountered the related problem, but it was not fixed in the end because no one could prove that it could be actually exploited.

This vulnerability has been lying dormant in PHP for more than a decade. It has been touched by people more than once, but no one has ever turned it into a real exploit.

The 2020 bug report that was almost ignored | Image source: Calif

The reason is not that no one thought of it, but that it is too laborious. Independent author Nick Rogers said in his analysis article that turning this type of vulnerability into a usable exploit requires "weeks of tedious manual debugging", and no one was willing to pay that cost for it in the past. He named this state: security by exhaustion, which ensures security by tiring attackers to the point of giving up.

A large number of old codes at the bottom of the Internet are in this weird but awkward state. Theoretically there are vulnerabilities, but when it comes to actual attacks, all parties find it too much trouble, so they just leave it as it is.

What changed this situation was a program called "Patch the Planet" launched by OpenAI in June this year: it provides funds and models, inviting security companies to audit open source software that the whole world relies on. Calif is one of the participants, and it set its target on PHP.

On August 1, Ryan Austin, a researcher at Calif, started the audit with AI. According to Calif's public technical article, AI served as an "audit partner" and an agent in this audit: it sorted out PHP kernel code, tracked the execution path of the program, and the key defect of the first vulnerability was discovered by the agent in the kernel code. Only a few days after the audit started, the first problem surfaced.

On August 11, Calif reported the vulnerabilities to PHP: the team asked AI to summarize the "pattern" of the first vulnerability into a reusable skill file, which is specially used to search for the same type of defects. The second vulnerability was found using this skill file.

After AI finds a vulnerability, it can package the method of finding it to look for the next one.

Calif restored the scene of AI audit with comics | Image source: Calif

Oh by the way, according to OpenAI's official blog post, Calif did not use dedicated AI cyber offensive and defensive tools like Daybreak this time, nor did it use cutting-edge flagship models like Astra, but cheaper models like GPT-5.6 Sol.

Almost at the same time, another security company Wiz also came across the same set of vulnerabilities. On August 19, researchers from Wiz, using their own tool Wiz Atlas, Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol, independently discovered the first vulnerability. The next day, they verified remote code execution on Drupal; on the third day, they also successfully verified it on WordPress.

Wiz wrote in its blog that the cutting-edge model helped the team analyze the cause of failure and adjust repeatedly, making the exploit run on multiple applications "within a few hours". Its conclusion is: "One researcher completed in a week the work that used to take the world's top teams several months." Wiz gave the biggest credit to Gemini 4 Argon in this discovery, and Raluca Ada Popa, head of Gemini security at Google DeepMind, also stated that this demonstrates "why cutting-edge AI will change the landscape of cyber defense".

Two companies, three AI models, within three weeks, came across the same set of vulnerabilities from two directions. OpenAI and Google each emphasized the contribution of their own models, which in itself shows that using AI to find vulnerabilities has become a track for head-to-head competition among leading AI companies.

What AI has changed seems to be not just "whether it can be discovered", but more about "whether it is worth doing". When the cost of finding vulnerabilities, verifying vulnerabilities, and adapting exploits to different environments drops from "top teams for several months" to "one person for a week", or even "a few hours", all the vulnerabilities that were "too tiring to be worth exploiting" in the past have become worth exploiting. According to Rogers, AI has pushed the marginal cost of cyberattacks "to zero" for the first time.

This also explains why the two companies stumbled upon the same set of vulnerabilities within three weeks. Calif specifically stated that when the vulnerabilities were first discovered, "no special tools were used, nor were models that ordinary people cannot access used." The defending party can find it with public models, and the attacking party can do the same.

Putting PHP2Shell back into the past two years, we can see a gradually igniting fuse: in November 2024, Google announced that its AI project Big Sleep found a previously unknown vulnerability in the database software SQLite, claiming that this was the first time AI had found an exploitable vulnerability in widely used real software.

In April this year, Anthropic stated that the preview version of Claude Mythos found thousands of zero-day vulnerabilities in tests, including a 27-year-old vulnerability in OpenBSD. Because of its strong capabilities, this model was not made public, and only provided to more than 40 institutions that maintain critical software.

In July, the WordPress core vulnerability chain wp2shell discovered by AI was made public, and then it was exploited on a large scale by attackers.

It took two years to go from "being able to find vulnerabilities" to "making governments shut down websites" | Image source: GeekPark

From "AI can find vulnerabilities" to "the vulnerabilities found by AI are so dangerous that the models dare not be made public", and then to "the vulnerabilities found by AI made government websites shut down". The changes AI brings to cybersecurity have for the first time evolved from technical news inside the security circle to a reality felt by the whole society.

For this current chaotic situation, OpenAI also tried to save face in its blog post: the same capability that helps discover vulnerabilities "can also help attackers quickly develop exploit tools".

This is no longer an assumption. On the day PHP2Shell was disclosed, Jake Knott, a researcher at watchTowr, said that the attack attempts they observed on the decoy server used tools partially written with the help of AI. "No one has succeeded so far, but we don't think this will last long."

In the past year, the cases of attackers using AI have escalated rapidly. In November 2025, Anthropic disclosed that an organization identified as state-sponsored used Claude Code to launch intrusions against about 30 targets, and 80% to 90% of the tactical operations in the attacks were completed autonomously by AI.

In May this year, the Google Threat Intelligence Team reported that an attacker developed a usable zero-day exploit with the help of AI and planned to launch a large-scale attack, which was blocked in advance by Google. This is considered the first time an attacker has successfully created a zero-day exploit using AI. John Hultquist, chief analyst of Google Threat Intelligence, said that AI can not only review code on a large scale to find vulnerabilities, but also "create usable exploits, which used to be a very high threshold".

By September, in Anthropic's threat intelligence report, the cases had become large-scale operations: an organization suspected to be related to Russian intelligence agencies used AI agents to automatically rewrite malicious programs after security software alarms, targeting more than 20 government departments and defense institutions; a group of Chinese-speaking operators used AI "agent clusters" for reconnaissance and vulnerability development, one of which produced more than a dozen suspected zero-day vulnerabilities in a month; an independent hacker actor used AI to write a WordPress zero-day exploit, which successfully compromised at least 14 out of 42 targets.

As stated in Anthropic's report, AI has shifted the cost back to the defending party. In the past, launching a complex attack required a team, but now one person plus several AI agents is enough.

The Defending Party's Time Window

On the day PHP2Shell was disclosed, OpenAI also made a judgment: similar discoveries will increase sharply in the next few months.

This statement has been confirmed by existing data. The day before PHP2Shell was disclosed, on October 20, Google released the official version of Chrome 156, which fixed 353 security vulnerabilities in this single version. A year ago, the numbers for Chrome 141 and 142 were 21 and 26 respectively.

Within a year, the number of fixes per single version has increased more than tenfold | Image source: GeekPark

The list of reporters has also changed. Among the 6 highest-level "critical" vulnerabilities in Chrome 156, 4 were reported by Xinyang Ge, a researcher at Anthropic, one of which is clearly marked "with assistance from Claude"; another one came from OpenAI's Codex Security. The names of AI companies have appeared in batches in the security announcements of the browser with the largest number of users in the world.

5 out of 6 critical vulnerabilities were reported by AI companies | Image source: GeekPark

The first reason for the sharp increase is that the method of finding vulnerabilities can be replicated. The skill file in PHP2Shell is an example: in the past, the experience of a top security researcher was difficult to replicate; now, it can be turned into a file and handed over to countless agents to run at the same time.

In fact, there is still a huge amount of "stock" waiting to be dug up on the Internet. At the bottom of the Internet are decades of accumulated old code, including PHP, browsers, operating systems, and various open source libraries. No one can count how many vulnerabilities like PHP2Shell that "were touched long ago but are too difficult to exploit" exist in these codes. They used to be protected by the fact that "it is too much trouble", but this layer of protection is disappearing.

This is also why all leading