AI-discovered critical PHP vulnerability triggers surge in cyberattacks

On October 23, 2026, NPR reported that AI technology discovered severe vulnerabilities in the mainstream programming language PHP, leading to a rapid surge in global hacker attacks and prompting governments worldwide to rush into implementing safety measures. Later that day, an analysis on juejin highlighted the PHP2Shell vulnerability, pointing out that AI uncovered a flaw hidden for two decades in just two days, while the official patch process dragged on for two months. This situation exposes the lagging maintenance capacity of the open-source ecosystem. With 69.3% of websites running on PHP and the foundation maintaining it operating on a monthly budget of less than $700, the incident reveals that while AI accelerates vulnerability discovery by tenfold, the human response and remediation capacity remain severely stretched.