Security professionals and government agencies globally recently mandated emergency updates for website administrators after a nonprofit programming foundation identified critical security gaps.
These vulnerabilities, labeled PHP2Shell, were discovered by independent cybersecurity researchers leveraging advanced artificial intelligence. Which can employ far more complicated attempts to hack past security barriers than humans could, the PHP2Shell vulnerabilities were found through several advanced AI models.
The flaws had remained dormant within the widely utilized open-source web language, PHP, for over a decade, largely because their complexity made them nearly impossible for human developers to identify without high-level AI assistance. However, because it would have been too complicated for humans to exploit them without the use of advanced AI, they had gone unnoticed. Humans must pore over them to weed out false positives, but the scans themselves cost money – used to pay for the tokens for AI models – and afterwards. “They are helping a lot, but we need more active players in this area,” Potiuk said, “because it’s highly disproportional – the impact it has on the corporate world versus the open source world”.
Government and corporate portals were briefly taken offline to implement the necessary patches. Experts warn that PHP2Shell is likely the first in a series of security crises sparked by emerging AI technologies. A significant portion of the global digital backbone is managed by volunteer communities that often struggle with limited resources, time, and staffing to address threats at this intensity.
Peter Slattery, a research scientist at MIT’s FutureTech who studies how cybersecurity professionals adapt to new technologies, noted that many in the AI safety sphere predicted this outcome. He emphasized that digital infrastructure serves as a primary frontline where the harmful potential of AI will first manifest. Slattery’s database tracks an increasing surge in both the discovery and potential exploitation of such flaws, suggesting that actual real-world attacks are increasingly inevitable. According to slattery, The database of incidents he and his colleagues maintain shows that an increasing number of vulnerabilities are being detected, and it is a matter of time before some are exploited in the real world. If found by a malicious hacker and exploited before there is a chance to patch devices, could have caused a major disruption, a bug like that.
PHP originated in 1995 when programmer Rasmus Lerdorf developed a tool to track visitors to his online resume. The project evolved into a global collaborative effort, eventually supporting approximately 70 percent of all websites, including major platforms like Wikipedia and Facebook. In 2021, the PHP Foundation was established as a nonprofit to oversee this vital development, though it continues to operate under constrained financial conditions.
The current internet ecosystem is heavily dependent on open-source software, from browser technologies like Mozilla Firefox to core server infrastructure like Apache HTTP Server. “That was the moment when the whole ecosystem realised how important it is to take care of open source,” he said.
Amanda Brock, CEO of the nonprofit OpenUK, highlighted that even proprietary software vendors fundamentally rely on this volunteer-driven code.
While corporate giants such as Google, Meta, OpenAI, and Anthropic benefit from this structure, they are now deploying their own AI tools to probe for vulnerabilities that these smaller foundations are ill-equipped to resolve quickly. “It’s simply not possible with the resources in place to fix all of the known vulnerabilities,” Brock said. “Foundations are attempting to manage these challenges, but the smaller ones don’t have hundreds of millions in funding, and managing this at the pace AI requires is proving impossible.”.
The pace of discovery has accelerated dramatically. Google reported finding over 1,000 security bugs in a single Chrome update, far exceeding previous records. Mozilla identified over 400 vulnerabilities in April alone, up from 76 the previous month. Jarek Potiuk, a member of the Apache Software Foundation’s volunteer security team, indicated that AI tools are generating roughly ten times the volume of usual reports, forcing developers to spend exhaustive time verifying and fixing these issues. According to “We have maybe 10 times more issues than usual because we are using AI to find them,”, Jarek Potiuk, part of the volunteer security team at the Apache Software Foundation. (In keeping with the foundation’s non-hierarchical ethos, Potiuk said he has no real title). “Every project, every foundation is doing this right now – spending enormous amounts of time to find these issues,” Potiuk said. “AI helps to find them, but you have to verify things, you have to review them.”.
Efforts to manage this deluge are underway. Anthropic’s Project Glasswing provided $100 million in credits for its Claude Mythos model to scan for vulnerabilities, identifying over 23,000 bugs across 1,000 projects in just one month. Similarly, the Alpha-Omega project—backed by firms including Microsoft, Amazon, and OpenAI—invests approximately $7 million annually to assist open-source developers in securing the 290 packages managed by the Apache Software Foundation. Anyone could download, modify and share improvements, as with other open-source coding projects.
Despite this, experts argue that the corporate sector, which holds trillion-dollar valuations largely built on free, open-source infrastructure, must increase its contribution. Potiuk emphasized that the burden on volunteers remains disproportionate compared to the immense value these corporations derive from the software. As the industry grapples with these AI-driven scans, the fundamental challenge remains ensuring that critical infrastructure—which powers everything from personal devices to global data systems—can be secured in time. Which allowed hackers to remotely run code on millions of devices through a widely used library maintained by the Apache Software Foundation, underscored the critical role open-source so, the 2021 Log4Shell vulnerability. Suddenly, cars, microwaves and a host of electronic devices connected to the internet were vulnerable, Potiuk said.
