PHP’s security scramble is just a preview: AI is digging up flaws faster than maintainers can fix them
The New Stack Paul Sawers ● Covered by 13 sources
PHP had to ship emergency fixes after two critical bugs set off service shutdowns. AI is now finding serious flaws faster than maintainers can patch them.
Based on reporting by The New Stack, Paul Sawers — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Two critical bugs in PHP have triggered a messy scramble across the web. Businesses, hospitals, schools, and government agencies have temporarily shut down sites and online services while they try to blunt the impact of flaws that could let unauthenticated attackers run malicious code on affected servers.
The PHP project issued emergency fixes on Wednesday for versions 8.2 through 8.5. Older releases are no longer officially supported, though some vendors and distributions still provide legacy fixes, and PHP has also published limited patches for 7.4 through 8.1. Cloudflare put firewall protections in place. Automattic said sites hosted across WordPress.com, WordPress VIP, and Tumblr were secured. The Wikimedia Foundation took some supporting services offline until patching is done.
But the bigger story is how these flaws came to light. OpenAI said security firm Calif found one of them using its GPT-5.6 Sol model, while Google-owned Wiz independently found both. OpenAI also said it spent two months coordinating with PHP maintainers, security researchers, Cloudflare, and government cybersecurity agencies as part of its Patch the Planet effort. That process got tangled when Chainguard released patched PHP container images more than six hours early, after CEO Dan Lorenc said the company had independently rediscovered the bug with a frontier AI model and the prompt “find bad vulnerabilities in PHP.”
The PHP Foundation pushed back hard, saying the early release could help attackers and that there were no confirmed exploits, only people trying to exploit the issue. Nils Adermann, a PHP Foundation board member and Composer co-maintainer, called the move irresponsible and unprofessional, and said it ignored weeks of coordinated disclosure work.
What makes the episode feel bigger than one language is the speed gap. Anthropic said Claude found 493 security issues across 25 open-source projects, including one configuration flaw that had gone unnoticed for 21 years. The industry is getting very good at finding bugs. Fixing them, especially when compatibility, performance, and third-party extensions are on the line, is still slow, expert work.
My take — AI-written commentary, not fact-checked reporting
This is the part of AI security nobody wants to put on a slide: discovery is cheap, remediation is not. The more models help people find flaws, the more upstream maintainers get buried under reports, excuses, and all the usual unpaid labor. Open source doesn’t have a magic patch fairy; it has volunteers and a growing queue.
Read more about this at: The New Stack