This week, governments in Canada, Brazil, Germany, the Netherlands, Finland and Denmark started pulling websites offline, and Wikimedia did the same, because of two bugs in PHP that let an attacker run code on a server without logging in. They were named PHP2Shell, scored 9.2, and reach back to PHP 5.4, which means the vulnerable code has been sitting in the language behind most of the web since 2012.
Wiz found them with AI models, Gemini among them, reading PHP’s core error handling, the piece that aborts a request when memory runs out and sometimes leaves half-built internal state behind that the engine later trusts. That is white-box analysis at a scale no corporate security team ever had, and it is becoming the normal way serious bugs get found.
The numbers from the last six months are hard to absorb. Anthropic’s Glasswing partners reported more than 129,000 verified vulnerabilities between April and July, Chrome patched over a thousand security bugs in two releases, and curl’s maintainer, who ended his bug bounty in January because fewer than one report in twenty was real, now says the hallucinated slop is gone and his problem is good findings arriving faster than anyone can fix them. Discovery became cheap, so the bottleneck moved to verification and patching, where humans still live.
That is also the honest answer about pentesters. XBOW topped HackerOne’s US leaderboard last year, yet in Cobalt’s 2026 survey the share of companies willing to rely on a fully autonomous pentest fell from 29 percent to 9, because buyers saw the noise. HackerOne’s newest product is called Validation. The junior tester who runs scanners is in trouble, while the person who decides which finding is real, exploitable in this business, and worth an emergency patch has never been more valuable. The pentester is becoming the one who says no to the machine.
The systems that will break are not the ones you think. OpenBSD fixed a 27-year-old bug in weeks because it has maintainers and a release cycle, while a water utility’s PLC on Windows XP has neither, and in August CISA and NSA published their first advisory on AI-generated exploit scripts aimed at Siemens controllers in at least twelve US states. The Five Eyes agencies said it plainly in June: the timeline is months, not years.
PHP got patched in a day. The next PHP2Shell will sit in code nobody is paid to maintain, and the machine will find it just the same.