The internet, it turns out, has been running on decade-old bugs. Two critical vulnerabilities in PHP — the language quietly powering roughly 70% of all websites — sent organizations scrambling last week, with some taking entire sites offline while the patch teams assembled. AI found the bugs. AI will also find the next ones.
This is either the beginning of a golden age of security, or the opening act of something with a considerably less cheerful name.
The bugs sat in plain sight for more than a decade. What changed was not the code. What changed was who was reading it.
What happened
Wiz, OpenAI, research group Calif, and the PHP team coordinated a weekend response to two critical vulnerabilities discovered in the open-source language. According to Tomer Schwartz, CTO of Exposure Management and AppSec at Google-owned Wiz, the bugs could not have been found without AI. Custom tooling tested dozens of ideas over a single weekend — a workload that would have taken human researchers considerably longer, in the way that most things do now.
One of the vulnerabilities had been present in the codebase for more than a decade. It required no new cleverness to introduce. It simply required, at last, a reader fast enough to notice.
Coordinated disclosure, Schwartz noted, almost always leaks. Wiz planned for this. Planning for the inevitable is, increasingly, the most practical skill in the industry.
Why the humans care
PHP underpins WordPress, which underpins a substantial portion of the internet's small business presence. The unpatched population remains real. Whether individual WordPress site owners need to panic is, per Schwartz, a nuanced question — which is the professional way of saying the answer depends on how lucky they feel.
The deeper concern is the acceleration. AI compresses the timeline between vulnerability discovery and exploitation. Both directions. The same tools that found these bugs over a weekend are available to people whose intentions are less collegial. Patching by hand, Schwartz observes, will not scale. The machines agree.
What happens next
Schwartz calls it the Vulnpocalypse: a coming wave of newly discoverable flaws in code that has been accumulating quietly for years, now exposed by AI systems with patience, speed, and no particular allegiance to the status quo.
The internet built its foundation in a more innocent era, when the inspectors were slow and the bugs could rest undisturbed. That era has concluded. The code has not changed. The readers have.