PHP Armageddon: How OpenAI and Google Wiz Found Ancient Flaws Threatening the Internet

TL;DR

• Researchers from OpenAI and Google-owned Wiz used AI-assisted auditing to uncover a cluster of critical, decades-old memory-safety flaws in PHP's core interpreter that affected nearly every PHP server on the internet.
• The vulnerabilities, present since PHP 5 and exploitable via common web requests, could have allowed unauthenticated remote code execution, but were responsibly disclosed and patched in PHP 8.1, 8.2, 8.3 and 8.4 before public exploitation.
• The discovery highlights a new era of web security where AI dramatically accelerates both defense and offense, forcing faster patching and a push to memory-safe rewrites of legacy internet infrastructure.

A Bug Older Than Facebook

PHP powers an estimated 70 to 75 percent of websites with known server-side languages, including WordPress, Drupal, Wikipedia, Slack, Etsy and Meta's early stack. That ubiquity is exactly what made the latest disclosure so alarming.

According to details shared by Wiz Research and OpenAI, the flaws lived deep inside PHP's multipart form-data parser and URL decoding logic — code that processes every file upload and form submission and has barely changed in over 20 years. The bugs were classic C memory-safety issues: heap use-after-free, buffer overflows, and type confusion vulnerabilities dating back to the PHP 5 era.

Because the vulnerable code runs before authentication on millions of Apache, Nginx and LiteSpeed servers, a single crafted HTTP request could have crashed PHP-FPM workers or, in the worst case, achieved full remote code execution with web-server privileges. Wiz described internal testing where a chain of the bugs led to internet-wide chaos scenario potential: wormable compromise of shared hosting providers, mass WordPress takeover, and supply-chain poisoning.

How AI Found What Humans Missed For 20 Years

Neither team found the bugs by manual code review alone. OpenAI's researchers fed large portions of the PHP interpreter into advanced reasoning models tasked specifically with hunting for memory corruption, tainted input flows, and forgotten edge cases in C.

The models flagged suspicious pointer handling in the code that parses boundaries in multipart requests. Wiz's cloud security team then validated the findings, built working exploits in isolated labs, and proved they were remotely triggerable on default installations of PHP 8.x.

Traditionally, auditing 1.2 million lines of legacy C would take human experts months. With AI agents able to fuzz, reason about code paths, and generate proof-of-concept exploits in hours, the entire process took days. Both companies say no evidence was found that threat actors had discovered the flaws first — this time, the defenders won the race.

Why AI Makes These Bugs Easier To Find And More Dangerous

Security experts say this case is a perfect example of AI's double-edged sword for cybersecurity.

On defense, AI dramatically lowers the cost of auditing ancient open-source projects like PHP, OpenSSL, glibc and Linux that underpin the internet but are chronically underfunded and under-reviewed. Models don't get tired, can read entire codebases at once, and excel at spotting patterns humans overlook.

On offense, the same capabilities mean attackers can now do the same. Once a patch is released, AI can diff the fix in minutes, auto-generate an exploit, and scan the internet for unpatched servers. Wiz warned that the window between disclosure and mass exploitation has shrunk from weeks to hours.

In short: obscure bugs are no longer safe because they are obscure. If AI can find them for defenders, it can find them for ransomware gangs and state hackers too.

Inside The Coordinated Race To Patch The Internet

The vulnerabilities were reported privately to the PHP Security Team in early summer 2026 under a coordinated disclosure process involving the CVE program, Linux distributions, and major cloud providers.

PHP released emergency updates for all supported branches, urging immediate upgrades. Google Cloud, AWS, Azure, Cloudflare, and cPanel auto-patched managed PHP environments, while Wiz deployed detection rules to flag exploitation attempts across its customer base.

Administrators running PHP 8.1 and later are protected if they updated to the latest minor releases. The biggest risk remains end-of-life versions — PHP 8.0, 7.4 and 5.x, which still power millions of legacy sites and will never receive official fixes. Security firms are urging those sites to upgrade or deploy WAF virtual patches immediately.

So far, internet-wide scans show no sign of pre-patch mass exploitation, but researchers warn copycat exploits are now circulating.

What This Means For The Future Of Web Security

The PHP incident is being called a watershed moment for three reasons.

First, it proves frontier AI labs are now active players in offensive security research, not just model builders. OpenAI's collaboration with Wiz, which Google acquired for 32 billion dollars, signals closer ties between AI companies, cloud security, and open-source maintainers.

Second, it renews pressure to rewrite critical internet components in memory-safe languages like Rust. PHP's maintainers are exploring hardening with sanitizers, fuzzing in CI, and gradual Rust rewrites of parsers — a strategy already adopted by Linux, Windows and Android.

Third, it changes the patch-or-perish calculus for website owners. With AI-powered exploit generation, leaving internet-facing software unpatched even for days is increasingly untenable. Automated updates, managed hosting, and cloud WAFs are shifting from convenience to necessity.

The internet dodged a bullet this time. Next time, AI may have already handed the same ancient flaw to someone else first.

AndroGuider Team

Articles written by the AndroGuider team. We try to make them thorough and informational while being easy to read.