The PHP Meltdown: How AI Is Making Old Bugs More Exploitable

Security researchers used AI tools to help uncover years-old vulnerabilities in the PHP web scripting language—and then the AI-assisted attacks began.

By Lily Hay Newman and Matt Burgess | Security | October 24, 2026

When security researchers set AI tools loose on PHP, the ubiquitous web scripting language that underpins a huge share of the internet, they expected to surface some latent flaws. What they found instead was a trove of years-old vulnerabilities—and, soon after, evidence that attackers were using AI to exploit them at scale.

The episode, now widely referred to as the "PHP Meltdown," has become a defining case study for a question that has shadowed the AI boom: as AI lowers the barrier to finding and weaponizing software bugs, does it make every vulnerability more exploitable?

The Discovery

The research effort combined large language models with automated code-analysis pipelines to comb through large portions of PHP's codebase and ecosystem. The AI systems flagged suspicious patterns and edge cases that human reviewers had missed for years—some dating back well over a decade. What once required months of specialized manual auditing was compressed into weeks.

Crucially, the same capabilities that helped defenders find these bugs are available to attackers. Within a short window of the vulnerabilities becoming public, researchers observed AI-assisted exploitation attempts—automated scanning, payload generation, and rapid adaptation of attack techniques that would previously have demanded significant expertise.

Why It Matters

AI doesn't create vulnerabilities out of thin air. But it changes the economics of exploitation:

• Speed: AI can scan, hypothesize, and generate exploit code far faster than human teams.
• Scale: Automated tools can probe thousands of targets simultaneously.
• Accessibility: Attackers with less expertise can leverage AI to bridge knowledge gaps.
• Persistence: Old, forgotten bugs in widely used software become newly attractive targets.

The Defender's Dilemma

In 2026, the security community is grappling with an uncomfortable symmetry: the same AI advances that empower auditors and bug-bounty hunters also empower adversaries. The PHP Meltdown underscores the urgency of patching legacy code, shortening disclosure timelines, and adopting AI-assisted defense as a baseline rather than a novelty.

For organizations running PHP-based infrastructure, the lesson is blunt: assume that any latent vulnerability in your stack will be found—by someone, and likely with AI's help. The window between discovery and exploitation is narrower than ever.

via Wired AI