A security research effort aimed at making PHP safer has instead become a case study in how AI is compressing the time between a bug's discovery and its exploitation. Researchers used AI tools to dig up long-standing vulnerabilities in PHP, the scripting language that quietly runs a large share of the web. Within a short window, attackers were using AI-assisted methods of their own to exploit what had just been found.
PHP isn't a niche tool. It powers WordPress, which alone runs roughly four in ten websites, along with countless custom business sites, e-commerce platforms, and internal tools built over the past two decades. Many of these vulnerabilities had existed for years, buried in code that nobody had closely re-examined since it was written.
The research team used AI models to scan PHP's codebase for patterns associated with known bug classes — the kind of tedious, pattern-matching work that used to take skilled human auditors weeks. The AI didn't need to understand PHP the way a veteran engineer does; it just needed to recognize code shapes historically linked to exploitable flaws. That sped up discovery considerably.
The complication is that the same approach works for people trying to break in, not just those trying to lock the door. Once details of the flaws began circulating, attackers reportedly used comparable AI-assisted techniques to build working exploits far faster than the traditional reverse-engineering process normally allows.
Why it matters
This fits a pattern security researchers have been warning about for a couple of years: AI tools are lowering the skill and time required on both sides of the vulnerability fight. Historically, there was a predictable lag — sometimes days, sometimes months — between a vulnerability becoming public and someone building a reliable exploit for it. That lag gave IT teams, hosting providers, and software vendors a window to patch systems before real damage occurred.
That window is what's shrinking. Large-scale incidents like Log4Shell in 2021 showed how chaotic a scramble to patch can get even with weeks of lead time. If AI tools are cutting the exploit-development timeline from weeks to hours, the margin for a slow patching process gets a lot thinner, and that math doesn't change based on how big or small the business running the affected software happens to be.
What this means for small businesses
If your website, online store, or booking system runs on WordPress or another PHP-based platform — and a large share of small business sites do — you are downstream of this story whether you know PHP exists or not. The practical risk isn't that someone is targeting your business specifically; it's that automated scanning tools, now assisted by AI, can sweep the internet looking for unpatched sites running known-vulnerable software.
The defense hasn't fundamentally changed, but the urgency has. Automatic updates for your CMS, plugins, and themes matter more than ever, as does choosing a hosting provider that patches server-level software quickly rather than leaving it to customers. A web application firewall, which filters malicious traffic before it reaches your site, is a relatively cheap layer of protection worth asking your host or developer about if you don't already have one.
Worth noting: this isn't a PHP-specific problem long-term. The same AI-assisted vulnerability hunting is being applied to other widely used codebases, so the lesson extends beyond any one piece of software your business happens to run.
What to watch
Keep an eye on security advisories from your hosting provider or CMS vendor (WordPress, in particular, publishes regular security releases) and note how quickly patches are pushed out after disclosure. Also watch whether major hosting companies start advertising AI-assisted threat detection as a selling point — that would signal the defensive side is catching up to the offensive one, at least for now.
The bottom line
The time between a vulnerability becoming known and it being actively exploited is getting shorter because of AI tools, which means keeping software updated — automatically, not manually, whenever possible — is less optional than it used to be for any business running a website.