AI Tooling Unearths Decade-Old PHP Flaws, Highlighting Patching Challenges
Wiz researchers used AI to uncover critical vulnerabilities in PHP, exposing the limits of manual security patching as automated tools accelerate flaw discovery.
A recent wave of critical vulnerabilities in PHP has sparked an industry-wide scramble, forcing organizations to remediate systems and, in some cases, take affected websites offline entirely until fixes could be applied. Because PHP serves as the underlying language for roughly 70% of websites across the globe, any widespread flaw carries immediate consequences for internet infrastructure. Yet according to the security researchers behind the discoveries, this incident represents only the starting point of a broader shift in vulnerability discovery.
The findings were detailed on TechCrunch's Equity podcast by Tomer Schwartz, the CTO of Exposure Management & AppSec at Google-owned cloud security firm Wiz. Schwartz worked directly alongside OpenAI, research group Calif, and the PHP core team to investigate and resolve two critical bugs. The coordinated response demonstrated not only the high stakes of open-source maintenance, but also the unprecedented speed at which modern security research now operates.
How AI Accelerated the PHP Bug Discovery
During the podcast discussion with reporter Rebecca Bellan, Schwartz revealed that Wiz could not have uncovered these specific flaws without the assistance of artificial intelligence. Security researchers deployed custom tooling capable of evaluating dozens of hypotheses over the span of a single weekend, rapidly identifying attack vectors that human analysts had overlooked.
Remarkably, one of the identified bugs had sat in plain sight within the code for more than ten years. While the code had remained public and accessible for over a decade, shifting conditions and dependencies eventually aligned to make the underlying flaw exploitable. The fact that an automated, AI-driven process uncovered the vulnerability in days—after a decade of passive exposure—illustrates how dramatically the vulnerability landscape is changing.
Schwartz noted that coordinated disclosure processes also present practical operational challenges. In modern security operations, information leaks are virtually baked into disclosure timelines, requiring teams to prepare mitigation strategies well before official security advisories go public.
The Scaling Limits of Manual Patching
The incident brings into focus the operational difficulties facing organizations of all sizes. Even as fixes become available, a substantial number of systems remain unpatched. The risk extends from large enterprises managing custom infrastructure down to small business owners operating standard WordPress installations.
More fundamentally, the episode highlights that traditional, manual patching cycles cannot keep pace with automated vulnerability discovery. When automated systems and machine learning models can audit large, aging codebases and test multiple exploitation paths in hours, defenders relying on manual reviews and ad-hoc patch updates will consistently lag behind.
What it means for developers
For engineering teams and early-stage startups, these disclosures underline the need to build with security in mind from day one. Relying on the assumption that mature, widely used open-source libraries are thoroughly vetted is no longer a viable defensive posture. Flaws that have lingered unnoticed for years can suddenly become urgent liabilities once AI-based research tools are applied to the code.
Developers must recognize that patching by hand is no longer a scalable defense. Teams should look toward automating dependency monitoring, implementing continuous updates, and systematically testing application security before deployment. Furthermore, developers building automated code-auditing pipelines or experimenting with AI-assisted software analysis can access leading models—including Claude, GPT, Gemini, and DeepSeek—through pay-per-token pricing via a single API key at https://apixoai.online.
As vulnerability discovery accelerates, engineering organizations will need to adapt their workflows to match the speed of modern disclosure cycles. Ensuring rapid deployment pipelines, understanding coordinated disclosure risks, and auditing legacy components will be essential steps in staying ahead of automated exploitation.
Source: The 'Vulnpocalypse' is coming for the internet’s aging code, says Wiz’s CTO — TechCrunch AI. Written by the Apixo team from that report.
One key for Claude, GPT, GLM, DeepSeek and more. Pay per token with crypto.
Get your API key
