AI sparks bugmageddon as PHP flaw proves offense-defense speed race

Concerns are growing over a so-called "bugmageddon" after a critical security vulnerability in the programming language "PHP," which threatens websites worldwide, was found through artificial intelligence (AI). As AI uncovers vulnerabilities that went undetected for a long time or had no confirmed exploitability, cyberattacks and defenses are turning into an "AI speed race." Experts say the security paradigm must shift from the traditional approach of responding after an attack to rapid, preemptive action using AI.

◇ PHP flaw found 2 years ago… AI reproduced the attack in a week

According to the cybersecurity industry on the 24th, the critical PHP security vulnerability "PHP2Shell" (CVE-2026-109618, CVE-2026-109619), disclosed on the 21st, was proven exploitable during AI-driven research. PHP is a programming language widely used to build websites such as WordPress. The flaw allows malicious code to run on a server without a separate login, meaning sites can be exposed to attacks even if individual security hardening is in place.

The vulnerability was first detected in 2024 during an external security audit by the PHP Foundation. At the time, the developers identified an error occurring under out-of-memory (OOM) conditions but could not find a concrete attack method. Patches were also delayed due to compatibility issues with existing programs and decision-making delays.

Things changed in Aug. this year. U.S. security firm Caliph analyzed PHP code with OpenAI's AI model "GPT-5.6 Sol" and found a way to execute server commands without login, reporting it to the development team on Aug. 11. Google's security firm Wiz also independently found the same vulnerability using "Gemini 4 Argon" and "GPT-5.6 Sol." They then reproduced attacks on platforms including WordPress and reported the results.

In a technical report on the 21st, Wiz said, "A task that previously required a top-tier security research team to perform over several months was completed by a single researcher in a week." In effect, AI has lowered the barriers of time and expertise needed to develop real-world hacking methods.

The PHP Foundation developed and validated patches over two months and released an emergency security update on the 21st. Users should update to the latest version with the vulnerability fixed.

◇ AI finds flaws buried for decades… Hacking and defense become an 'AI speed race'

The security industry views the PHP case as a prime example that AI can be used on both sides of cyber offense and defense. In the past, security experts analyzed source code directly or used tools to find errors; now, AI can uncover complex flaws and even develop real attack methods.

This year has also seen a series of cases where AI was used to find long-standing vulnerabilities. Anthropic said on the 2nd that it used AI models including "Claude Mythos Preview" to discover 6,157 vulnerabilities across 591 open-source projects. In OpenBSD and FreeBSD, flaws that had existed for 27 and 17 years, respectively, were identified. In June, security firm DebsFirst analyzed 1.5 million lines of code in the multimedia software FFmpeg with AI and found 21 vulnerabilities. Some had been left unattended for more than 20 years.

The problem is when attackers exploit AI-discovered vulnerabilities first. If attackers find a flaw before a patch is released, damage can spread even before fixes come out. In fact, Amazon Threat Intelligence detected PHP2Shell attack attempts on the 17th, four days before the official patch release. Whether attackers used AI or actually compromised servers has not been confirmed.

◇ 'Bugmageddon' becomes reality… urgent need to shift to preemptive security

As AI uncovers security flaws at scale, concerns over "bugmageddon" are growing. Bugmageddon is a portmanteau of "bug," meaning software defect, and "Armageddon," meaning cataclysm. It refers to a situation where the pace at which AI finds vulnerabilities and develops attack methods outstrips the security response capabilities of corporations and developers.

In fact, the PHP Foundation said it has assigned CVEs to 15 vulnerabilities since July 1 and reviewed more than 100 incorrect or duplicate reports. As AI accelerates vulnerability discovery, the burden of validating and fixing them has grown.

The security industry believes the traditional approach of responding only after disclosure makes it hard to stop the spread of attacks. With AI handling everything from discovery to exploit development to security patches, cybersecurity is turning into a "speed race" between attackers and defenders.

Im Jong-in, emeritus professor at the Graduate School of Information Security at Korea University, said, "In the past, post-incident response centered on fixing vulnerabilities after an attack, but now the security paradigm is shifting to preemptive defense that finds and patches vulnerabilities before attackers by using AI," adding, "Since AI can generate not only complex attack code but also patch code to block it, what matters is who finds and responds to the vulnerability first."

He added, "Small and midsize corporations that find it difficult to build their own AI security systems should use cloud-based AI security services," and "If the government offers them at low expense through the AI foundation model specialized for cybersecurity now underway, it could strengthen small and midsize corporations' response capabilities."