AI Is Finding Software Bugs Faster Than Anyone Can Fix Them

The researchers who found the PHP2Shell bugs were blunt about what the AI in their toolchain did and didn't do. "No model is simply capable of unearthing 'all bugs' with simple prompts. At least for now," the security firm Calif wrote in its write-up, as quoted by TechCrunch. Hold onto that line when you see headlines about machines finding flaws faster than people can fix them. The headlines are mostly right, and the details are stranger.

A pile of separate stories has landed on the same point. Google launched a model built to hunt vulnerabilities. Anthropic published exploit chains from a model it hasn't released. OpenAI said its own agents found a hole in a widely used compression library. And the world's most common web language needed emergency patches. Here's how they fit together, who comes out ahead, and what a small site owner can do before lunch.

The PHP bugs were old. What changed is who can use them

The two flaws are called PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619. They let someone with no password run code on a server over the internet, and they've sat in every version of PHP since version 5, released in 2004 (TechCrunch). PHP sits behind roughly 70% of web-facing sites, including WordPress, Drupal, Joomla and MediaWiki.

Nobody had cracked them. The PHP Foundation saw the bugs in 2024 and left them unpatched because there was no practical way to exploit them (TechCrunch). Earlier this year researchers at Calif worked out how to exploit them, with an AI model helping, as part of OpenAI and Wiz's open source security program. One of TechCrunch's podcast hosts first said AI models found the holes, then corrected it in the write-up: human researchers found them and used AI to exploit the bug (TechCrunch).

We think that correction is the most useful fact in the whole saga. Models spotting bugs is the smaller shift. The bigger one is that bugs filed under "theoretical" become real once a model can adapt an exploit to different setups. Wiz put it this way in its own post, as quoted by TechCrunch: "With AI this is no longer a barrier. LLMs can help adapt an exploit to different PHP versions, configurations and memory layouts."

The patches went out in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, after big hosts and cloud companies got an early look under embargo. The NSA then told site owners that anything that couldn't be patched immediately should come off the internet, and banks, retailers, hospitals and some government agencies did exactly that (TechCrunch).

Attacks started before the patch

Amazon said its honeypots logged an attempt against both flaws four days before disclosure. Cloudflare reported attempts climbing from tens of thousands within 45 minutes of the announcement to millions by the next morning (The Hacker News). The PHP Foundation blamed one company for pushing patches live hours before the embargo ended. That can't explain activity days earlier, and as of the coverage we read, nobody has said how the early attacker found out.

Then the attacks got specific. The security firm Dream traced a suspected China-nexus operator who chained PHP2Shell with a Linux kernel flaw and rooted 25 servers, three of them inside a U.S. government-affiliated network. The targets were firewall appliances running PHP 8.0.30. "The implementation we recovered is a custom, non-public build, not a copy of any known public exploit for PHP2Shell," Dream's researchers said (The Hacker News). They also found Claude Code installed in the attacker's infrastructure, along with an offensive-security tool wired to DeepSeek and Kimi models, which points to AI help in building the tooling. Attribution here is Dream's read, not an established finding.

CISA confirmed active exploitation five days after the patches, adding both flaws to its Known Exploited Vulnerabilities catalog with three days for civilian federal agencies to fix their systems (TechCrunch). One more honest note: some researchers say a reliable exploit has been harder to build than feared, and early attempts to drop a Mirai botnet variant have so far failed (The Hacker News).

Google built the scanner everyone wants, and most of us can't run it

Google announced Gemini 4 Carbon as the PHP cleanup dragged on, calling it its strongest model with "state-of-the-art cybersecurity and long horizon capabilities" (Google). The company says Carbon scores 88.2% on SEC-bench Pro for finding real vulnerabilities, 54.8% on ExploitGym for exploiting them and 71.0% on CWE-bench for writing the fix. It also says the Chrome team found Carbon more than 10 times better than another lab's frontier model at producing high-quality patches. Wiz, which Google owns, reports Carbon leading its web penetration-testing benchmarks.

Those are Google's numbers, run without guardrails, and the three benchmarks measure different things, so don't subtract one from another. What stands out is that patching is on the scoreboard at all. The Verge notes Carbon beating GPT-6 Astra on SEC-bench Pro and topping an independent intelligence index with Claude Opus 5.5 behind it (The Verge).

Then the catch. Carbon is open only to a subset of cyber defenders, widening through Google's Fairwind Program, while Google gathers feedback on guardrails and works through the U.S. government's voluntary pre-release testing. The company promises developers and businesses access "as soon as possible" without a date. The launch price is $2 per million input tokens and $10 per million output, and Google's footnote says it rises to $4 and $20 after the introductory period.

Anthropic and OpenAI are making the same argument

Anthropic's Frontier Red Team published five exploit chains from an unreleased, internal research model, covering Chrome, Safari, Android, Windows and Linux. The Chrome chain strung together four flaws, ending in code running outside the browser sandbox. The Linux one gave a root shell over the network with no login. Anthropic says it reported every flaw to the vendor first. For Chrome alone, it says 62 CVEs have been assigned and patched, all rated critical or high, 13 of them sandbox escapes (Anthropic). Its stated reason for publishing: "Now, it's something models can do with little human involvement, and then prove by producing a working exploit that anyone can run and verify."

Treat that as a claim, which is how The Hacker News treated it. Apple and Google credit Anthropic researchers, working with Claude, for specific fixes, and that part can be checked. How much of each chain the model built unaided can't be, since Anthropic doesn't break down what a person did at each step. The Hacker News also found that two of the public CVE records don't describe the flaws quite the way Anthropic's post does. Access for vetted security professionals runs through its Cyber Verification Program, which covers Claude Opus among other models.

OpenAI's version, per Reuters, came with a confession. After a research model used a configuration error to reach the internet earlier this year, the company paused its most advanced training, tightened security and restarted it once the new controls were in place. To test the new defenses it set teams of AI agents loose to break out. They found a flaw in Brotli, a compression library used by Node.js, Bun and Envoy. The detail we keep returning to: OpenAI says the root cause was fixed in Brotli's source code months earlier, before anyone knew it was a vulnerability, and no new version shipped. A fix existed for months. No release carried it until OpenAI disclosed the flaw.

OpenAI's launch post for its Patch the Planet program with Trail of Bits explains why humans stay in the loop. Frontier models, it says, "produce a high volume of false positives that can contribute to the already overwhelming backlog maintainers are facing," so Trail of Bits reviewed every finding before a maintainer saw it (OpenAI). The program uses Codex Security and has so far turned up hundreds of issues across 19 projects.

Finding got cheap. Fixing didn't

The mismatch fits in a picture. Everything on the top row now runs at machine speed. Everything on the bottom row still needs a person with a calendar.

Start with the people at the bottom. TechCrunch notes that open source maintainers are often unpaid and can't afford third-party security reviews, while companies that depend on their work often don't contribute (TechCrunch). Disclosure rules were also designed for slower times. Anthropic's policy gives developers 90 days to patch, with 45 more before details are discussed beyond an advisory. PHP2Shell saw attempts four days before disclosure and confirmed attacks five days after the fix.

Sean O'Kane said on TechCrunch's Equity podcast that at the "bone level of the internet" everything is "held together with glue and dreams" (TechCrunch). Wiz's CTO of exposure management and application security, Tomer Schwartz, joined the same show to argue that patching by hand won't scale (TechCrunch). We agree with the second point more than the first.

Who gains, who's exposed

Our view: don't buy a new security suite because of this news. The people hurt in these stories weren't missing a product. They were running an unsupported PHP branch, or waiting on a vendor with no patch date, or had nobody who read the advisory. The cheapest defenses are boring ones, and the one that pays off most is knowing within an hour whether a given advisory applies to you.

If you run a site, do this first

We'd put one question ahead of everything else: which PHP version is my site running, and who patches it? Most small site owners can't answer without asking someone. Then work down this list.

1. 1Find your PHP version in your hosting panel, or ask your host. Supported branches got fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and TechCrunch says 8.1 and older no longer get patches.
2. 2On WordPress, the CMS statement is that this isn't a WordPress flaw. You patch the server and work with your host, so email them and ask for a written answer.
3. 3If you can't patch now, take the site offline until you can. That's the NSA's guidance, and it's hard to argue with when the alternative is a rooted server.
4. 4Set session.upload_progress.enabled=0 if you can live without upload progress bars. PHP listed it as a mitigation for CVE-2026-109619 and again for a third, lower-risk advisory, CVE-2026-115560, which has no emergency fix yet (The Hacker News).
5. 5After patching, check logs for exploitation starting at least a week before the fixes shipped, since Amazon's honeypots logged an attempt four days before disclosure.
6. 6List every box on your network that might run PHP behind the scenes, such as a firewall or a NAS, and ask each vendor for its patch date.

If you write software rather than host it, don't wait for Carbon. Scanners you can use today are covered in our look at what AI vulnerability scanners find and miss, and the top AI code review tools post compares reviewers like CodeRabbit and Snyk Code. Budget time for triage, because the first run produces a pile, and OpenAI's own program says why. Every ToolRank board for AI cybersecurity tools and the code review and testing board are the places to compare options, and AI tools for security analysts covers the people doing this work full time.

Score yourself below. Anything under five points means your first hour should go to the two-point items.

What we're watching

Three things. Whether Google opens Carbon past the Fairwind partners, and at what price once the introductory rate ends. Whether Anthropic names or ships the model behind its chains, since a capability only a few vetted teams hold isn't one defenders and attackers have equally. And how the first PHP2Shell attacker knew in time, which still has no answer.

The next fix to watch for is PHP's third advisory, CVE-2026-115560, which PHP says arrives in its next routine release. Read the notes the day it ships, and check your site's version again.