AI models find two critical PHP flaws, and defenders need to start patching at machine speed

AI models, including OpenAI's GPT-4o and Google's Gemini, have identified two critical vulnerabilities in PHP. According to the short video report this piece is based on, both flaws were rated 9.2 on a 10-point severity scale. On the scales commonly used to rate vulnerabilities, anything above 9 counts as critical.

PHP is the server-side language and runtime that generates web pages before they reach a browser. The same report says it powers roughly 70% of websites. That reach matters more than the scores themselves. A flaw in a niche library affects a few projects. A flaw in the engine itself can affect much of the web at once.

The report gives no further detail. It doesn't say who ran the models or how they were directed. It doesn't say whether the bugs have CVE identifiers (the standard public IDs for vulnerabilities), whether patches exist, or whether anyone has exploited them. We won't fill those gaps. Until the technical details are published, this should be read as an early report, not a full account.

Our reading: this is the dual-use story we keep coming back to, and this time it points the right way. We've argued that the meaningful cybersecurity signal isn't saturated benchmarks. It is real-world, expert-level work that nobody walks the model through. Finding critical bugs in software as mature and heavily audited as PHP is exactly that kind of signal, assuming the details hold up. It also shows that this capability doesn't need the newest frontier models. GPT-4o is not the current state of the art. If older general-purpose models can do this, the capability is already widely available.

That creates a short-term risk. Attackers have access to the same models, and the gap between a bug being found and being exploited is shrinking. The weak point is patching. Millions of sites run outdated PHP versions, and their owners update slowly. Finding a bug in hours does little if fixing it in production still takes months.

The long-term picture is more encouraging. Core internet infrastructure has long depended on a small number of overworked open-source maintainers. If AI can audit that code continuously, critical bugs get found by defenders first, and the shared software everyone relies on gets safer. The policy priority should be getting these tools to maintainers and speeding up patch distribution, not restricting the capability.