AI models find two critical PHP flaws, more evidence that bug hunting at scale has become a dual-use capability

AI models, including OpenAI's GPT-4o and Google's Gemini, found two critical vulnerabilities in PHP, according to the short video report we are working from. Both were rated 9.2 on a 10-point severity scale. PHP is the language and engine behind roughly 70% of websites on the planet.

The source doesn't say who ran the research, whether the flaws have been patched, or what technical method was used. So we can't judge how much of the work the models did on their own and how much depended on human researchers guiding them. That distinction matters.

Our reading: this fits a pattern we keep seeing. AI is becoming a useful tool for auditing old, widely used code that nobody has fully reviewed in years. That is good news for defenders, because foundational infrastructure can be cleaned up faster than human teams alone could manage. It is also a reminder that this is dual-use capability, meaning the same tool works for attack and defense. A model that finds a bug for a maintainer can find it for an attacker too. The response should be governance, not panic: coordinated disclosure, fast patching, and prioritizing the software everything else runs on. In the short term, risk rises. In the long term, cheap automated auditing could make the web much more secure than it is today.