AI Found the Bug. Volunteers Had to Fix It. What PHP2Shell Means for Your Business

If you've heard me go on about PHP2Shell a lot this week, sorry. (Not sorry.) Two articles and a free checker later, I want to step back from the "patch it now" advice and talk about the bit that's been bugging me: how this bug was found, who had to fix it, and why I think weeks like this are about to become normal.

The short version of what happened

PHP is the software underneath WordPress, WooCommerce, Drupal, Laravel and most shared web hosting. It runs on around 70% of websites where the server-side language is known. On 21 October the PHP project rushed out fixes for two critical flaws, now called PHP2Shell, that can let an attacker take over a web server without logging in.

The fixes were planned for the next day, but details leaked early, so PHP brought them forward. Attacks started within hours. The NCSC sent more than 50,000 warnings to UK organisations, and the government switched off 32 of its own services as a precaution. If you want the practical detail, here's the full explainer and what the government outages mean for you.

AI found it first

Here's the part that making me feel a bit different about things - PHP2Shell wasn't found by a lone genius in a hoodie, it was found with AI.

Security firm Calif used one of OpenAI's models to spot the flaws in August, as part of an OpenAI programme to find and fix bugs in old software. Separately, the research team at Wiz found the same bugs using AI models from both Google and OpenAI alongside its own tools. According to OpenAI's president, the bug had been sitting in PHP for 14 years.

That's genuinely good news, in one way. The good guys found it first. But it also tells us something about the next few years: if AI can find a 14-year-old bug in one of the most-used pieces of software on the planet, it can find a lot more of them. And it's not just the good guys with access to these tools.

It's not just PHP

This is already happening everywhere. A few examples from this year:

Linux. In May, Linus Torvalds said the kernel's private security mailing list had become "almost entirely unmanageable", partly because lots of people were running the same AI tools on the same code and reporting the same bugs.
OpenSSL, the software that encrypts a huge chunk of internet traffic. Its security inbox went from around nine reports and enquiries a month to around 70. Matt Caswell, who runs the OpenSSL Foundation, put it well: reports are "cheap to write" but still expensive to assess.
curl, the little tool that moves data around inside almost every app and device you own. Its lead developer, Daniel Stenberg, says security reports this year are coming in at a little over double the rate of 2025, and lately more than one a day. Many of them are really good, which is exactly the problem: each one needs a person to deal with it.
Google paused part of its open source bug bounty programme on 1 October after a flood of automated reports, most of which turned out not to be valid.

So you get both problems at once: a pile of rubbish to sift through, and a growing pile of real bugs that need fixing.

The house of cards

This is the bit I keep coming back to. A huge amount of the software your business relies on every day, often without knowing it, is open source. Free to use, built and looked after by small teams, and in a lot of cases by volunteers in their spare time.

PHP is a good example. The week PHP2Shell landed, the PHP Foundation's executive director, Elizabeth Barron, told Reuters it has one full-time member of staff and 14 mostly part-time contractors. Its board are unpaid volunteers, and the money comes from donations and grants. She also said the project is getting nearly twice as many proposed code changes as a year ago, but "the number of contributors hasn't doubled."

Let that sink in for a second. Software running most of the web, looked after by one full-time person and a handful of part-timers.

And that's where the pressure is lopsided. Finding a bug now costs a few prompts. Fixing it still costs a person's evening. Testing the fix, coordinating with everyone who packages PHP, writing the advisory, answering the questions: all human work. Then every host, agency and business in the world has to actually install it. AI has sped up the first step enormously. The rest still moves at human speed.

Honestly? I'm not sure how this house of cards stays standing long term. Nobody fully is. But I don't think it's about to fall over tomorrow either.

It's not all doom

There are some genuinely hopeful signs, and it's worth being fair about them:

Defenders get the same tools. PHP2Shell was found by researchers, reported properly, and fixed. That's AI working for us. PHP's security team says it now uses AI tools from OpenAI to help check incoming reports.
Money is starting to move. The PHP Foundation has a new ecosystem security team funded by a grant from Alpha-Omega, a project that funds open source security. OpenAI says it will put $1 billion into subsidising its security tools for organisations with limited resources.
Projects are setting rules. Linux now asks for AI-found bugs to come with a working, checked example, which cuts down the noise.

None of that fixes the basic mismatch overnight. But it's a start, and the conversation is finally happening in public.

What this means for your business

You can't fix open source funding on your own (if you can, please call me). What you can do is make sure your business is ready for the next "patch it today" week, because I think there'll be more of them. Five things:

Know what you run. Make a simple list: your website and what it's built on, who hosts it, the plugins, and the key online services your business can't work without. You can't patch what you don't know you have.
Know who patches it, and how fast. For each item, write down who's responsible for updates. For your website, ask your host or developer how quickly they apply critical fixes, and get the answer in writing. Cyber Essentials gives you 14 days for critical updates. Weeks like this one show why faster is better.
Decide in advance who can pull the plug. The NCSC's advice this week was to take systems offline if they couldn't be fixed quickly. That's a much easier call if you've already agreed who makes it, and how you'd tell customers.
Make sure warnings can reach you. Sign up for the NCSC's free Early Warning service. It tells UK organisations when it spots a problem with their internet addresses.
Give a little back, if you can. If your business makes money from a WordPress site, a little support goes a long way. The PHP Foundation takes support of any size, and it's worth asking your web agency or host whether they contribute to the projects they build on.

Homework for this week: pick one item from that list and do it. Number one is a good place to start.

The new normal

I don't think PHP2Shell was a one-off. AI is making bugs cheaper to find, for everyone, and the people fixing them haven't multiplied. That means more weeks where the right answer is "update today", and businesses that know what they run and who to call will get through them calmly.

If you'd like a hand working out what your business runs and who patches it, or you're worried something's already been hit, I'm here. You can check your website's PHP version in under a minute with my free PHP2Shell checker.

AI found the bug. Volunteers had to fix it.