What AI can now do·Oct 21, 2026·Cyber
AI finds two critical flaws in PHP, the software under about 70% of websites
about 70%of websites run PHP
Three teams independently found two memory-safety flaws in PHP's core using frontier models; PHP shipped emergency fixes on Oct 21, 2026.
How far it has travelled
Demonstratedshown once, by its developer or a researcher
yes · Oct 21, 2026 · Wiz describes finding the flaws with its own AI agent plus Gemini 4 Argon and GPT-5.6 Sol; Calif reported the same flaw to PHP in August under OpenAI's program. source
Reproducedshown again by someone else
yes · Oct 21, 2026 · Three teams reached the same flaws independently, and attackers reproduced working exploits within days. source
Accessibleavailable to the public or to customers
partial · Oct 21, 2026 · The models are publicly available; the vulnerability-research workflows that found the flaws are not published. source
Reliableworks most of the time on a defined task
unknown · No published success rate for AI-driven discovery of flaws of this severity in widely used software.
Real consequenceshas changed something in the world, for good or ill
yes · Oct 23, 2026 · PHP2Shell: governments from the Netherlands to Japan took public services offline as a precaution; millions of exploit attempts; no confirmed breach as of Oct 23. source
What this could change for you
Government, bank and hospital websites went offline for days as a precaution; the flaw sits under software most people use without knowing it.
Incidents it made possible
- 70PHP2Shell: AI-found PHP flaws leak, trigger global shutdownsWS-0135 · Oct 21, 2026 · WS-4 Severe
Sources
primary source, second source.
A milestone is a dated, sourced result that moved what AI can do; a stage is upgraded only when a source shows it (a reproduction, a public release, production evidence, a documented consequence). “Unknown” is the honest default.
