php2shell: AI-found PHP flaw hits 70% of the web, OpenAI cashes in

The php2shell episode is notable less for the discovery itself than for the sequence that followed. Multiple research teams, working separately but all using AI models to hunt for flaws, converged on the same two PHP vulnerabilities. The find was treated as an emergency, yet the public learned of it only on Oct. 20, when the PHP foundation said a critical patch would arrive within 24 hours. That gap — between private knowledge and public disclosure — is where the trouble began: according to AWS, exploitation started on Oct. 17, before the coordinated 14:00 UTC Oct. 21 disclosure time that several organizations, including Amazon, had agreed to. Once the exploit was public, the floodgates opened, with millions of attempts recorded as sites scrambled to patch. The service most affected, WordPress, reported no issues, but many governments and some private entities chose to take services offline rather than risk damage — a defensive move that protected sites but deprived users of access. For OpenAI, the same event that exposed the risk also validated a commercial bet: its Daybreak program, which gives vetted organizations access to its most sophisticated defensive tools, has been growing rapidly, and co-founder Greg Brockman has publicly promoted OpenAI's role in the discovery. The company is planning a cybersecurity-focused model this fall, suggesting it sees defensive AI as a revenue line rather than a side project. Whether that bet pays off may depend on how well the tools hold up against the same class of AI-powered attacks they are meant to counter.