In early August, security researcher Sagi Tzadik ran a routine experiment with an artificial intelligence agent at cybersecurity firm Wiz. He instructed the AI to take a security vulnerability it had recently uncovered in WordPress and investigate whether the exact same weakness could be exploited in Drupal, another widely used content management system that powers millions of websites worldwide. Eight hours later, the AI agent returned with its report, stating that the cross-platform attack had failed. However, it added a critical postscript: in the course of its automated trials, it had stumbled upon an entirely separate, deeply buried flaw in PHP—the foundational programming language that drives both WordPress and Drupal, and currently underpins as much as 70% of the entire web.

Tzadik initially assumed the AI had simply made an error, a common occurrence for large language models known to hallucinate details under complex analytical workloads. But when the Wiz team manually examined the finding, they realized the exploit was entirely real. It took advantage of a fundamental weakness that had sat undetected and unpatched within the core architecture of PHP for more than a decade.

Unbeknownst to the Wiz team at the time, researchers at another cybersecurity firm, Calif, working in close partnership with OpenAI, had independently used AI to discover a related flaw in the software ecosystem. This parallel discovery highlights a profound new reality in the tech industry: once artificial intelligence systems reach a specific threshold of capability, the discovery of longstanding, hidden software weaknesses ceases to be a matter of if, and becomes a matter of when. Major AI developers have increasingly sought to get ahead of this curve by granting early access to advanced models to trusted security defenders like Wiz and Calif. The goal is to ensure that the good actors find and remediate critical bugs before equivalent capabilities inevitably trickle down into the hands of malicious hackers. In this instance, that preemptive strategy worked, but only by the slimmest of margins.

The dramatic episode offers a clear window into a high-stakes new phase of cybersecurity, one where AI dramatically accelerates the timeline for both defense and offense. While the subsequent public disclosure of the bugs naturally triggered widespread anxiety about the long-speculated "cyber-apocalypse"—a hypothetical scenario where AI discovers world-melting vulnerabilities and plunges modern society into immediate digital chaos—the specialists who navigated the crisis remain surprisingly optimistic about the long-term implications. According to Tzadik, the ability to leverage automated intelligence means the industry is now identifying and fixing vulnerabilities at an unprecedented rate, a development that ultimately strengthens the security posture of the web as a whole.

Yet, a close examination of how the incident unfolded reveals just how perilously close things came to an unmitigated disaster. Word of the severe vulnerabilities began leaking and circulating online prematurely, a full two days before the official, coordinated patch was scheduled for public release. Recognizing the escalating danger, PHP’s core maintainers scrambled to pull the release schedule forward by a day.

Despite this emergency adjustment, chaos quickly ensued. Hours before the patch was fully available to the global public, Calif mistakenly published a video demonstrating the exploit in action. The visual proof acted like kindling, and copycat attempts multiplied exponentially across the internet. Infrastructure giant Cloudflare recorded thousands of malicious attempts even before the official public announcement was made. Within 45 minutes of the disclosure, that number surged into the tens of thousands; within two hours, it hit hundreds of thousands; and eventually, it reached millions of automated attacks. Even after the official patch was finally distributed, numerous high-profile webpages, including critical government portals and sections of Wikipedia, were temporarily taken down as a precautionary measure while enterprise security teams scrambled to install the updates.

Reflecting on the near-miss, Tomer Schwartz, the chief technology officer of exposure management and application security at Wiz, noted that the timing could easily have gone the other way. If the vulnerability details had leaked even a month earlier, before a comprehensive patch had been developed and tested, the resulting digital crisis would have yielded a radically different and far more catastrophic outcome.

The successful creation of the patch itself was the result of a loosely organized, high-intensity sprint. After both Calif and Wiz independently submitted their alarming reports to the PHP maintainers, the rival security groups decided to join forces. Researchers from competing firms began sharing their sensitive findings in common communication channels, operating entirely without formal contracts or legal agreements governing the arrangement. Over the subsequent weeks, a dedicated ad-hoc group of roughly 15 people held daily discussions to trace the vulnerabilities back to their common source and collaboratively devise a robust fix. The entire high-stakes process, Schwartz observed, was maintained solely on mutual trust.

That collaborative model will inevitably face intensifying pressure as AI-driven discovery accelerates. OpenAI has publicly acknowledged that the PHP bugs were merely among "several significant vulnerabilities we’ve already found and are working to fix," while predicting that similar high-impact discoveries will increase sharply in the coming months. As these automated findings multiply, so will the volume of dangerous zero-day secrets waiting for urgent remediation. Schwartz emphasizes that the security industry can no longer rely on legacy procedures, noting that organizations must fundamentally rethink all of their internal processes, operational methods, and entire technology stacks simply to keep pace with the accelerating velocity of attackers.

While defenders are being granted a valuable head start through early access to advanced AI tools, they still operate under a permanent structural disadvantage. As cybersecurity veterans point out, malicious attackers only need to find a single open door and succeed once to breach a system. Defenders, conversely, bear the exhausting burden of ensuring that every single potential vulnerability across an infinite digital landscape is fully covered and secured.

Artificial intelligence is actively helping defenders meet this impossible standard by radically compressing research timelines. Previously, testing suspected software bugs could take weeks of tedious manual labor, forcing academic and commercial researchers to ruthlessly prioritize which hypotheses were most promising. Today, AI agents enable researchers to test dozens of complex ideas simultaneously. Tzadik notes that what used to constitute months of traditional security research can now be condensed down to a matter of days, or even just a couple of hours.

Despite these dramatic speed increases, the process remains intensely labor-intensive and far from fully automated. Even after the AI agent successfully helped Wiz uncover the critical PHP vulnerability, the model was entirely incapable of explaining how the underlying bug actually worked. Tzadik describes the AI’s generated explanations as "just slop," requiring him and his colleagues to spend days painstakingly untangling the root cause of the bug and manually reproducing it to verify its mechanics.

Financial constraints present another formidable barrier to widespread adoption. Joshua Saxe, the former AI security tech lead at Meta who left in February to co-found Abundance Security, points out that the operational costs are staggering. He is currently working with an organization that has burned through roughly $1 million utilizing Anthropic’s Mythos model simply to identify software bugs, with numerous vulnerabilities still left to uncover.

In the face of these rising costs and mounting technological pressures, industry leaders are grappling with a profound sense of disorientation. Saxe bluntly summarizes the current sentiment of the sector, observing that the industry feels very much like "deer in the headlights right now."

That sentiment is echoed across the upper echelons of cybersecurity operations. Adam Meyers, the senior vice president of counter-adversary operations at CrowdStrike, stresses that the margin for error has effectively vanished in the current threat landscape. In today’s climate, doing cybersecurity well is no longer an optional luxury or something that can be approached half-heartedly. Yet, Meyers remains pragmatic, noting that the occurrence of an exploit does not signal the end of the line for security teams. Instead, an exploit is merely the beginning of a larger, manageable conflict—marking the starting point of the attack lifecycle where defenders still have vital opportunities to intervene and mitigate the damage.