PHP2Shell: AI didn't find a new hole in the web. It made an old one cheap to exploit

The bug was old. The exploit was new.

Wiz's headline is built for the share button: "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet."¹ The body of the same post is more careful, and more interesting. "The underlying flaws had been present for decades," it says; what frontier models changed was the cost of "demonstrating their exploitability," a chain of steps "at the edge of what human researchers could practically achieve."¹ Calif, one of the credited teams, takes the story further back: an out-of-memory flaw in PHP was found in 2020, rediscovered in a 2024 audit, and left unpatched because nobody had proved it could be exploited.⁵

So the machine did not stumble onto a secret. It did the grinding part: chaining bugs, adapting to each target's memory layout, debugging failures until the thing worked. Wiz's own estimate is that a single researcher with frontier models finished in a week what "would have taken a world-class team months."¹ That is a vendor describing its own productivity, unaudited. It is also the sentence risk officers should reread, because "too hard to exploit" has quietly served as a control in a lot of risk registers.

Who found it, and who is selling the story

Credit is shared, and the accounts don't fully overlap. OpenAI says Calif identified a critical flaw using GPT-5.6 Sol under its "Patch the Planet" initiative, with Wiz "also independently discovering and reporting both vulnerabilities."³ Per the PHP Foundation, as quoted by SecurityWeek, Calif and OpenAI independently reported the out-of-memory-to-code-execution issue on Aug. 11; further attack paths came later from OpenAI and Wiz.⁵ Wiz dates its own first find to Aug. 19 and its report to PHP to Aug. 24, made with its Atlas tool, Gemini 4 Argon and GPT-5.6 Sol, and it singles out Argon for an "invaluable contribution."¹ Cloudflare names a fourth discloser, Quarkslab.⁴

One detail the Wiz post doesn't spell out: Wiz has belonged to Google since March 11, 2026.⁹ A Google subsidiary praising a Google model, with a quote from Google DeepMind's head of Gemini security attached, does not make the praise wrong. It does mean "AI uncovers" should be read as copy written by companies with models to sell, on both sides of the race. The honest headline is less catchy: humans with several AI systems, working in parallel, turned a known class of bug into a working weapon, and then spent two months making sure defenders got it first.

"70% of the Internet" is a market share, not a body count

The 70% figure is real, but it measures something narrower than the headline suggests. Cloudflare sources it to W3Techs, which puts PHP behind "almost 70% of websites"; Insurance Business notes the measure covers sites whose server-side language can be identified.⁴⁸ That is how widespread PHP is, not how many servers can be broken into today. Exposure estimates swing with method: VirusTotal counts more than 5.1 million exposed PHP hosts, as reported by BleepingComputer, while Palo Alto Networks' Unit 42 counts more than 22.6 million internet-facing systems that "could be vulnerable," as reported by Insurance Business.⁶⁸ We could not re-check either count. Anyone quoting a single number is choosing one.

Nine hours of head start, then a leak

The coordinated plan was disclosure on Oct. 22. Details leaked on Oct. 20, and PHP pulled its release forward a day.⁵ Cloudflare says its firewall rules protected free and paid customers by default from 03:02 UTC on Oct. 21, "about 9 hours ahead of public disclosure," and that it was already watching attackers mutate their payloads to slip past them.⁴ PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 that afternoon; CERT-EU logs the release at 13:30 UTC, ahead of the 14:00 UTC slot PHP had pre-announced.²⁷

Then the web did something it almost never does: it switched parts of itself off. The Dutch government took Overheid.nl, MijnOverheid and DigiD offline as a precaution, while saying it saw no sign yet of active abuse.¹⁰ Finland's state IT center began shutting public web services in the early afternoon.¹¹ Insurance Business adds UK councils, the Metropolitan Police and the Port of Rotterdam to the list.⁸ Exploitation attempts are real: watchTowr saw them hit its sensors around the time the patches landed, though it had observed no successful one when SecurityWeek reported it.⁵

What it means for money

Here is what the sources prove, and it is narrower than the alarm. No source we opened reports a bank, broker or fintech breached through PHP2Shell. What they do show:

• Online commerce is in scope by design. Sansec says Magento, Shopware and WooCommerce stores are exposed even when their own code is clean, and that Calif demonstrated unauthenticated code execution on Magento 2.4.9 and on the WHMCS billing platform, among others.¹²
• Secrets can leak without a break-in. One path discloses server memory that, per Wiz, may hold "passwords, authentication tokens, API keys and certificates" belonging to other requests.¹ For a payments or trading front end, that is precisely the inventory a thief wants.
• Insurers see an aggregation event. Insurance Business calls PHP2Shell "close to the scenario cyber underwriters have long modelled," and flags the open question of whether business-interruption cover responds when a client takes its own site down without a breach. The answer depends on the wording.⁸
• The long tail is on its own. Official releases cover PHP 8.2 to 8.5; PHP added minimal source backports for 7.4, 8.0 and 8.1, and otherwise points older installs to distributions and LTS vendors.² One scan cited by Insurance Business found nearly half of PHP sites that display a version number running releases older than the fixed branches.⁸

The fix is free, maintained largely by volunteers.⁸ Applying it is not free, and neither is the loss when someone doesn't. That is the responsibility question in plain clothes: the code is a commons, the downtime and the breach land on whoever runs the server. The PHP Foundation says AI has helped surface 15 new PHP CVEs since July 1.⁵ OpenAI says it expects findings like this to "increase sharply in the coming months."³ Read together, that is a forecast: patching that used to be a quarterly chore becomes a fire drill, and organizations that cannot inventory their own servers pay a tax the others don't.

Wiz writes that complexity "may no longer provide a meaningful barrier."¹ For anyone who priced cyber risk on the assumption that obscure bugs stay obscure, that is the line to underline. The flaw sat in the code for years. What expired on Oct. 21 was the discount for difficulty.