On October 23, 2026, the Electronic Frontier Foundation published a report detailing how AI models accelerated the discovery of severe vulnerabilities in open-source software.
AI and Vulnerability Discovery
According to the EFF, research into software vulnerabilities is being driven almost entirely by the cybersecurity capabilities of major AI models from companies like Anthropic, OpenAI, and Google. While finding unknown zero-day exploits was historically expensive and required specialized knowledge, the organisation states that AI models now make finding vulnerabilities cheap for anyone with moderate technical skill.
Recent vulnerabilities in PHP were found using a prompt to an AI model that literally asked it to find bad vulnerabilities in PHP. The EFF noted that vulnerability reports are rising exponentially, with thousands of new CVEs submitted in October alone.
PHP and Open-Source Maintenance
PHP is a programming language used mainly to create interactive websites, utilized by platforms such as Facebook, WordPress, Wikipedia, and Etsy. Because PHP is open-source, its maintenance depends on a small number of volunteers working in their free time.
A severe vulnerability discovered during a 2024 external security audit was initially deprioritised because maintainers could not find a way to exploit it. However, security researchers working with newer models independently rediscovered the vulnerability alongside another one with a functional exploit.
Coordinated Disclosure and Leaks
Following the rediscovery, researchers and the makers of PHP worked to patch the vulnerabilities and coordinate disclosure. However, news leaked via Hacker News, an accidental video publication by a researcher, and active exploitation observed by companies.
One company released a patch early, leading system administrators to scramble to secure their systems. The EFF also reported that other open-source projects, including Node.js and GitLab, had severe security bugs reported during the same week.
Key facts and where they come from
- PHP powers nearly 70% of the websites on the internet.
PHP that powers nearly 70% of the websites on the internet.
- Security researchers independently discovered PHP vulnerabilities with a way to exploit them using AI models.
security researchers working with the latest models from OpenAI and Anthropic independently discovered the vulnerability again, and another one—and now, with a way to exploit them.
- Other open-source projects like Node.js and GitLab also had severe security bugs reported.
Other widespread open-source projects like Node.js and GitLab also had severe security bugs reported.
