Deep dive: AI Finds the Bugs. Who Ships the Patches?

Why today

On October 21, PHP shipped emergency fixes across its whole 8.x line. They close two remote-code-execution holes, both scored 9.2 out of 10 for severity. PHP sits under WordPress, Drupal and MediaWiki, and Wiz puts its reach at 70% of websites. Within hours, the Canadian government took some federal sites offline on the advice of the Canadian Centre for Cyber Security. Agencies in the Netherlands, Finland and France did the same, and so did Wikimedia. What makes this the moment is how the bugs were found. Wiz Research says it found them with Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol. A firm called Calif, working inside OpenAI's Patch the Planet program, found overlapping flaws with GPT-5.6 Sol. Then a fight broke out over who deserves the credit. Under that fight sits the more useful question. If rented models can find bugs like these, what is the bottleneck now?

Plainly

Start with the bug itself, in plain words. When a PHP request runs out of memory or hits a fatal error at the wrong moment, the engine can leave its internal state corrupted. A later request then uses memory that has already been freed. A carefully built request turns that into running the attacker's own code on the server, with no login needed. According to Wiz, the flaw goes back about a decade, to PHP 5.4. It sat in plain sight because spotting it means reasoning about rare error paths across separate requests. Humans find that tedious. Models apparently do not. Wiz describes one researcher getting from discovery to working exploits in about a week. Calif's account is more guided. In SmartScope's summary of it, the researchers told the model to look specifically at abnormal handling when memory limits are reached. That matters, because PHP's own 2024 audit had already suspected an out-of-memory issue without finding a way to exploit it. Here is an analogy. Imagine smoke detectors suddenly became cheap and very sensitive. Every building gets one, and they start going off all over town. The fire department hasn't grown. Someone still has to decide which alarms are real fires, call the building owners and hand out extinguishers. Then they have to check that millions of tenants actually used them. Finding the problem got cheap. Everything after finding it still happens at human speed. The PHP timeline shows this. Wiz found its bug on August 19 and confirmed working attacks on Drupal and WordPress within two days. Then the pace collapsed. Wiz reported on August 24, and by its account PHP acknowledged the report on September 21. The patches shipped on October 21. That is two days to a working exploit and nearly two months to a fix. The fix itself is only the start, because every server still has to install it.

What the evidence shows

Some things are well established. The PHP Foundation has confirmed the two CVEs, the 9.2 score and the fixed releases. Its post also gives the reporting order. Calif, working under Patch the Planet, reported a working exploit on August 11. Wiz reported more attack paths on August 24, and OpenAI reported further ones on September 18. Several independent sources say the embargo did not hold. The CVE numbers leaked on October 20, carrying a wrong score of 10.0. Calif then accidentally published a proof-of-concept video, and the Foundation says it sped up exploit development. Chainguard released patched images about seven hours before the official release. SecurityWeek reports that Amazon saw exploitation four days before the patches were out. Cloudflare put firewall rules in place before disclosure, but its own post says the WAF does not replace patching. What is claimed but not shown is mostly about who gets the credit. The Guardian reports that OpenAI said it led a coalition of researchers and that frontier AI had been key. The researchers who found the flaw told the Guardian they used publicly available models. On the facts available, both statements can be true. Calif did report first, and did so inside OpenAI's program, yet the model it used is one anyone can rent. AI ethicist Joanna Bryson called OpenAI's framing lying ahead of its IPO. That is an opinion, not a finding. TechCrunch reports OpenAI saying the flaws were found before hackers discovered them. Amazon's report of attacks before the patch makes the safety part of that claim harder to sustain. Wiz's line that one person in a week did work that previously would have taken a world-class team months is Wiz describing its own work. Calif's guided approach suggests that human expertise in choosing where to look still did much of the work. The clearest piece of evidence comes from the maintainers. Since July 1 they have issued 15 CVEs and handled more than 100 reports that turned out to be invalid, duplicates or not reproducible.

How people read it

The AGI-forward reading starts from the overlap. Two teams using different model stacks independently found the same decade-old flaw within weeks of each other. In that reading, models are now finding vulnerabilities at the level of an elite human team. Discovery costs will keep falling, and attackers will have the same tools by default. The AI-realist reading starts with the same overlap and focuses on how the work was done. Humans picked the target, an area already flagged in a 2024 audit, and steered the models toward it. In this reading the models sped up an expert's search rather than replacing the expert. The pile of more than 100 invalid or duplicate reports shows that cheap discovery creates a lot of noise. Both readings agree on one thing: the slow steps came after discovery. The market reading is about positioning. OpenAI has a $1B subsidy program for defenders, according to Latent Space, and Google owns Wiz. Each lab has a reason to present this as proof that its own model is the one that matters. The policy reading looks at the takedowns. When Canada, France and others pull sites offline, the cost of slow patching becomes visible and political. It also lands on maintainers whom the PHP Foundation says depend on a small funded team and a little volunteer help. Neither the capability reading nor the realist reading changes that fact.

What it means for builders and investors

Our read is that finding bugs is turning into a commodity. The scarce work is now everything after discovery. That includes triage that can tell a real exploit from model-generated noise, and disclosure that can survive a leak. Above all it includes remediation across a long tail of old and forgotten deployments. Wiz says the bug reaches back a decade. The fixed releases cover only the 8.2 to 8.5 lines, so older installs have no official patch. That gap looks like a seed-stage wedge: knowing what is actually running, and fixing it or shielding it. Cloudflare's virtual patch before disclosure shows the value of that layer, and also its limits. For builders, a company that sells only AI bug discovery is competing against model features the labs give away. We'd want to see proof that a company changes outcomes after discovery, such as time to patch, coverage of end-of-life versions or a lower false-positive rate. One diligence question might be what share of a startup's reported findings maintainers have accepted as valid and new. Another is who did the work when the company claims a discovery. What would change our mind is evidence that models can patch and deploy across messy real-world fleets as cheaply as they find bugs.

What to watch

Three things would settle a lot of this. The first is a full post-mortem from the PHP Foundation or the coordinating parties. It should tell us how the leak happened and who knew what, and when. The second is patch-adoption data over the next few weeks. Scanning firms and hosting providers should show how fast the vulnerable PHP population shrinks, and whether old versions stay exposed. The third is the next case like this. If another long-lived flaw in widely used code turns up through rented models, discovery is a commodity, whoever claims the credit. If maintainers' rate of invalid reports keeps rising, that tells us triage is where the money and the hard problems are.