The internet runs on duct tape and prayer, and occasionally someone notices. This week, that someone was a pair of AI systems deployed by OpenAI and Google's recently acquired security firm Wiz, which together identified a cluster of severe vulnerabilities in PHP—the unglamorous scripting language that still powers roughly 77 percent of websites with server-side code, including WordPress, Facebook's legacy infrastructure, and countless enterprise applications that haven't been meaningfully updated since the Obama administration.

The flaws, some dating back over fifteen years, represent the kind of technical debt that accumulates when foundational software is maintained by underfunded open-source contributors while the tech industry chases shinier objects. What makes this discovery notable isn't just the severity—though early assessments suggest potential for remote code execution at scale—but the mechanism of detection. AI found bugs that human auditors missed for a decade and a half.

The scanner becomes the threat

Here is where the story curdles into something more uncomfortable. The same capabilities that allowed AI to identify these vulnerabilities—pattern recognition across massive codebases, the ability to reason about execution paths, understanding of obscure edge cases—are precisely the capabilities that make AI-assisted hacking increasingly viable. Security researchers have been warning about this symmetry for years, but the PHP discovery offers a concrete illustration.

Malicious actors with access to similar AI tools could, in theory, have found these holes first. Some may already have. The race between AI-powered defense and AI-powered offense is not theoretical; it is the defining dynamic of cybersecurity in 2026, and the defenders are not obviously winning.

The patch problem

Discovering a vulnerability is the easy part. The harder question is what happens next. PHP's fragmented ecosystem means patches must propagate through countless hosting providers, legacy applications, and organizations that lack dedicated security teams. Many affected systems are running on autopilot, maintained by developers who have long since moved on. The window between disclosure and exploitation has been shrinking for years; AI-accelerated discovery compresses it further.

Wiz and OpenAI coordinated disclosure responsibly, giving maintainers advance notice before going public. But the underlying dynamic remains troubling: AI can find bugs faster than humans can fix them, and the infrastructure of the internet was not designed for this tempo.

Our take

This is not a story about PHP being bad software, though it has earned its share of mockery over the years. It is a story about the strange new equilibrium we are entering, where artificial intelligence simultaneously strengthens and undermines the systems we depend on. The optimistic read is that AI will eventually tip the balance toward defenders, automating the tedious work of code auditing and vulnerability management. The pessimistic read is that offense scales faster than defense, and we are watching the early innings of a permanent crisis. The honest read is that nobody knows, and the PHP holes are just the latest reminder that the internet's foundations were never as solid as we pretended.