AI tools make old PHP bugs easier for hackers to exploit

Security researchers used AI tools to uncover vulnerabilities in PHP, the scripting language that runs many business websites. Wired reports that after these bugs were identified, attackers used AI to exploit them faster and more efficiently than before.

Why it matters

PHP supports a large share of business web applications, especially where companies use older code or open source platforms. The vulnerabilities found with AI were not new, but AI made them easier to spot and attack. This exposes technical debt: code that seemed safe because it had not caused problems for years is now more vulnerable.

According to Wired, attackers using AI can automate the search for weak code patterns and generate working exploits. This lowers the barrier for both experienced and less-experienced attackers to target businesses. Companies running legacy systems face a higher risk if their code has not been reviewed or patched in a long time.

AI speeds up attacks on old code

Wired describes how researchers used AI tools to audit PHP’s codebase and quickly found several vulnerabilities. Attackers then used similar AI assistance to build proof-of-concept exploits. This process was much faster than traditional manual review or exploit development.

PHP is used by both small businesses and large enterprises, so a wide range of sites could be affected. Many content management systems and e-commerce platforms depend on PHP. If a company has not updated its code, or relies on customized legacy systems, it is more exposed to these new AI-driven threats.

Security experts told Wired that AI use in finding and exploiting bugs is likely to increase. Any widely used language or framework with years of code could be targeted if AI tools are applied to them.

What this means if you run a business

Businesses relying on PHP-based applications that are not regularly updated face a higher risk of compromise. Code that once seemed safe due to age or obscurity can now be scanned and attacked at scale with AI. This changes how companies should view technical debt: leaving old code untouched is now a more direct security risk.

Companies should assess their exposure. This includes auditing PHP code for known vulnerabilities, applying security patches, and considering external security reviews. Automated code scanning tools, including those powered by AI, are available to defenders as well. But attackers are already using these tools, so response time matters. For cloud-hosted sites, ask your provider about their PHP patching schedule and related security practices.

This story fits into a broader pattern of AI raising the stakes for cyber risk. As seen in recent warnings from Anthropic, AI is making traditional risk assessments less reliable. For businesses, legacy code now requires more active management to avoid new threats.