Global web authorities recently instructed system administrators to apply emergency patches after cybersecurity experts uncovered severe long-standing security flaws in PHP, the open-source programming language behind roughly 70 percent of all websites. The vulnerabilities, dubbed PHP2Shell, had remained hidden in the code for over a decade because detecting and exploiting them without advanced artificial intelligence was previously too complex. Independent researchers discovered the flaws using AI, forcing corporate and government websites to temporarily take systems offline to implement critical fixes. However, because it would have been too complicated for humans to exploit them without the use of advanced AI, they had gone unnoticed. As well as those maintaining important software, say PHP2Shell could be the first in a deluge of security flaws exposed by emerging AI, but cybersecurity experts. “We are starting to see both a lot more vulnerabilities detected and addressed in time, but also attacks on a wide range of systems,” Slattery said. “We have been moving in this direction for a long time.
Technology professionals warn that PHP2Shell represents early warnings of a much broader systemic crisis facing global digital infrastructure. Peter Slattery, a research scientist at MIT’s FutureTech studying AI cybersecurity risks, noted that safety researchers have long anticipated harmful real-world impacts in this domain. He pointed out that tracking databases demonstrate a growing surge in identified software vulnerabilities, making widespread real-world exploitation only a matter of time unless defense strategies adapt.
Much of the modern internet relies on code created and maintained by non-profit groups and volunteers operating on constrained budgets. PHP originated in 1995 when Danish-Canadian programmer Rasmus Lerdorf designed a simple script to track visits to his online resume. The project expanded globally as an open-source tool, eventually serving as the foundational codebase for major platforms including Facebook and Wikipedia. In 2021, the non-profit PHP Foundation was formed to manage its ongoing development, though it continues to operate with limited financial backing. In 2021, a dedicated nonprofit, the PHP Foundation, was launched to coordinate development.
This volunteer reliance extends across the global internet architecture. Everyday digital systems depend on open-source browser software like Mozilla Firefox, programming languages including Python, Perl, and JavaScript, and server software such as the Apache HTTP Server maintained by the Apache Software Foundation. Amanda Brock, chief executive of OpenUK, emphasized that proprietary software vendors and multinational corporations rely fully on this open-source core for their underlying operations.
Trillion-dollar technology enterprises such as Meta, Google, OpenAI, and Anthropic build their services on top of volunteer-maintained code. However, the deployment of advanced AI scanning models by these very firms is uncovering coding flaws at a rate that far exceeds the operational capacity of non-profit maintainers. Brock warned that existing open-source foundations lack hundreds of millions of dollars in funding, making it nearly impossible to address all discovered vulnerabilities at the accelerated speed AI demands. Anyone could download, modify and share improvements, as with other open-source coding projects. “It’s simply not possible with the resources in place to fix all of the known vulnerabilities,” Brock said. “Foundations are attempting to manage these challenges, but the smaller ones don’t have hundreds of millions in funding, and managing this at the pace AI requires is proving impossible.”.
Advanced AI models detect flaws by running highly complex attack simulations that surpass human engineering capability. Consequently, tech organizations are reporting unprecedented spikes in detected software bugs. Google reported uncovering more than 1,000 security flaws during a single update for its Chrome browser, exceeding the combined total of its prior two dozen updates. Similarly, Mozilla recorded over 400 vulnerabilities in Firefox in a single month, breaking its previous record of 76 set just one month prior.
Jarek Potiuk, a volunteer security team member at the Apache Software Foundation, described an industry-wide trend toward using AI for automated system scans. He noted that while AI speeds up detection, review teams experience a tenfold increase in workloads because human experts must manually review findings to eliminate false positives. Additionally, non-profits incur substantial cloud computing costs paying for the AI model tokens needed to perform these scanning operations. According to “We have maybe 10 times more issues than usual because we are using AI to find them,”, Jarek Potiuk, part of the volunteer security team at the Apache Software Foundation. (In keeping with the foundation’s non-hierarchical ethos, Potiuk said he has no real title). “Every project, every foundation is doing this right now – spending enormous amounts of time to find these issues,” Potiuk said. “AI helps to find them, but you have to verify things, you have to review them.”.
Industry initiatives have emerged to assist open-source communities, though experts contend corporate support remains insufficient relative to commercial reliance.
Anthropic introduced Project Glasswing, allocating $100 million in computing credits for its Claude Mythos AI model to audit critical software, which flagged more than 23,000 vulnerabilities across 1,000 open-source projects in one month.
Meanwhile, the Alpha-Omega project—backed by Anthropic, Amazon, Google, Microsoft, and OpenAI—provides approximately $7 million annually to help maintainers scan code across the 290 software packages managed by the Apache Software Foundation.
Potiuk highlighted the massive disparity between corporate valuations and the minimal resources provided to open-source maintainers.
Highlighting previous incidents like the 2021 Log4Shell bug, which allowed unauthorized code execution across millions of connected devices through an Apache software library, he recalled how connected items ranging from vehicles to household appliances became instantly vulnerable. Potiuk stressed that keeping digital infrastructure decentralized, open, and adequately funded is vital, calling for far more active participation from tech giants to match the immense corporate reliance on free software. If found by a malicious hacker and exploited before there is a chance to patch devices, could have caused a major disruption, a bug like that.
