AI found a way to exploit a 22-year-old PHP vulnerability within two days

OpenAI recently disclosed that AI found a way to exploit a critical PHP vulnerability that had existed for 22 years within two days; the vulnerability has been fixed through a security update. The vulnerability could be used to steal passwords and databases, leak information, or take control of websites, and PHP powers about 70% of websites; its risk was warned about as early as July 2004 by security researcher Stefan Esser, and it had previously been difficult to exploit because attackers needed to make the server run out of memory at a precise point in time, relying on slow, repeated manual attempts. On July 30, 2026, researchers at Calif, a security company focused on AI, applied large language models to PHP in OpenAI's Patch the Planet program, found an attack method on August 1, and subsequently found multiple variants; Wiz later found more exploitation methods and called it one of the most severe vulnerabilities in software history. Vulnerability information leaked before the patch was released, and Cloudflare recorded thousands of attack attempts; CrowdStrike noted that old versions of PHP are still running and that the patch may not have solved all the problems.