AI just saved 70% of the internet. This time it told us first.

On Wednesday the web had its closest brush with disaster in years — and the fire alarm was an AI model. Researchers disclosed PHP2Shell: two critical flaws in PHP, the language running behind roughly seven in ten websites — WordPress, Drupal, Magento, the machinery under your corner store's checkout page. The bugs sat in PHP's code for over a decade, invisible. Both rated 9.2 out of 10 for severity. Either one can let an attacker with no login run code on a server, or read server memory holding passwords and tokens. Here's the part that matters: humans couldn't crack them. One research team said the exploit path sat at the edge of what human researchers could practically achieve. Then the AI models went to work — GPT-5.6 Sol through OpenAI's Patch the Planet program, Gemini 4 Argon in Wiz's hands — and a single researcher did in a week what once took a world-class team months. Within hours of disclosure, the internet did something it's never quite done before: governments pulled websites offline preemptively — France, Germany, the Dutch parliament, NHS Scotland. The NSA told admins to unplug if they couldn't patch. Cloudflare watched millions of exploit attempts roll in. OpenAI said the quiet part out loud: the same tools that find these flaws can hand attackers offensive tools and exploits just as fast. Today the white hats won the race. The day AI stops telling us first, the internet loses 70% of its armor at once. Sources: CNN — https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl ; Digital Watch — https://dig.watch/updates/php2shell-php-flaws-ai-emergency-patches ; MadRobot — https://madrobot.blog/2026/10/21/php2shell-critical-php-flaws-openai-gpt-5-6-sol-calif-wiz-patch-now/