AI tools exploit dormant PHP bugs on 40% of websites

Security researchers have demonstrated that artificial intelligence tools can drastically accelerate the discovery and exploitation of critical vulnerabilities in the PHP web scripting language. By leveraging large language models to scan codebases, these experts identified years-old bugs that traditional static analysis tools had missed. The implication is stark: the barrier to entry for launching sophisticated web attacks has collapsed, turning dormant security flaws into immediate, high-value targets for malicious actors. This development marks a significant shift in the landscape of software security, where the speed of automated discovery now outpaces manual auditing efforts.

The urgency of this situation stems from the ubiquity of PHP in the global digital infrastructure. Despite the rise of newer languages like Python and Go, PHP still powers a vast portion of the internet, including major platforms such as WordPress, which itself runs on roughly 40 percent of all websites. For years, the security community has relied on a race between white-hat researchers finding bugs and black-hat attackers exploiting them. However, AI changes the physics of this race. By automating the tedious process of code review, AI allows a small team of attackers to scan millions of lines of code in hours rather than months. This efficiency means that vulnerabilities which might have remained hidden in the shadows of legacy code are now being systematically unearthed and weaponized with unprecedented speed.

The practical impact of this AI-assisted exploitation is already visible in the rise of automated exploit kits that target known but unpatched PHP vulnerabilities. Attackers are no longer limited to the most obvious, high-profile bugs; they can now hunt for subtle logic errors and memory corruption issues that require deep contextual understanding to find. This creates a dangerous feedback loop where the abundance of available code on platforms like GitHub accelerates the training of these models, making them better at predicting where weaknesses might lie. For developers, this represents a fundamental challenge to traditional security practices. Relying on the assumption that obscure bugs will not be found is no longer a viable strategy. The economic cost of ignoring these AI-discovered flaws is rising as more servers are compromised, leading to data breaches, ransomware deployments, and service outages.

The path forward requires a complete rethinking of how software is built and secured. Organizations can no longer afford the luxury of long patch cycles or the assumption that their code is too complex for automated attacks. The next phase of this security arms race will likely see the integration of AI into defensive operations as well, using similar models to proactively identify and patch vulnerabilities before attackers can do so. However, the offensive capabilities currently outpace defensive adaptations, creating a window of vulnerability that is wide open. For any organization relying on PHP or similar legacy systems, the message is clear: audit your code immediately, update your dependencies, and assume that any known vulnerability has already been targeted by an AI-driven attack. The era of manual, slow-moving security audits is ending, replaced by a fast, automated, and highly efficient threat environment.