Earlier this month, website administrators around the world rushed to apply emergency security patches after researchers uncovered critical weaknesses in the code that underpins much of the internet. Independent cybersecurity experts using artificial intelligence discovered the vulnerabilities, nicknamed PHP2Shell, in PHP—an open-source programming language that runs about 70 percent of the world's websites, including Wikipedia and Facebook. The flaws had quietly existed in the software for more than a decade because they were too intricate for humans to detect or exploit without advanced AI assistance.
The discovery highlights a growing vulnerability in modern digital infrastructure. Major technology corporations depend on open-source projects, yet much of this shared code is maintained by unpaid volunteers or non-profit groups with modest budgets. PHP itself began in 1995 as a personal tool created by programmer Rasmus Lerdorf to monitor visits to his online resume. Although the PHP Foundation was launched in 2021 to coordinate development, it operates with limited resources, making it difficult to keep up when automated tools expose issues at unprecedented speed.
Software maintainers say PHP2Shell is just the beginning of a larger wave of AI-driven findings. Initiatives such as Anthropic's Project Glasswing have scanned millions of lines of code, uncovering more than 23,000 vulnerabilities across over 1,000 open-source projects in a single month. Similar efforts at Google Chrome and Mozilla Firefox have produced record numbers of reported bugs. However, while AI can scan systems rapidly, each alert still requires significant human labor to evaluate and verify. Volunteer developers must manually examine each report to weed out false positives and create secure fixes.
Cybersecurity experts warn that this gap between rapid automated detection and limited human repair capacity threatens essential systems. Amanda Brock, chief executive of the open-source advocacy group OpenUK, noted that smaller foundations lack the funding required to manage vulnerabilities at the pace AI demands. Maintainers argue that while commercial tech giants provide some financial assistance, the corporate world must contribute far more support to protect the free, volunteer-built software that powers global commerce.