The same AI that could exploit the bug is now patching it
A decades-old security flaw is being addressed by the same AI tools that could have exploited it.
The story
AI tools helped discover a critical PHP vulnerability affecting 70% of the internet, prompting urgent patching efforts before hackers can exploit it.
Source: fortune.com
Our reading
The PHP vulnerability was found by AI, but the real twist is that the same AI tools are also being used to fix it. The problem wasn’t new—just buried. For 14 years, the flaw sat in the codebase, ignored or underestimated. Now, with AI, it’s not just found—it’s weaponized, but in reverse. The same models that could have been used to exploit it are now part of the solution.
It’s like having a fire alarm that also doubles as a fire extinguisher. The system is self-correcting, but the correction is powered by the same technology that could have caused the fire. The PHP Foundation, which has been scrutinized for years, is now relying on AI to patch what it couldn’t see before. The irony isn’t in the flaw itself, but in the way the fix is being handled: a high-stakes game of digital whack-a-mole, played with the tools that made the problem possible.
The real cost isn’t the vulnerability, but the realization that even the most basic systems are now dependent on the same AI that could destabilize them. It’s a reminder that the tools we build to protect us are also the ones that could break us—and that the line between defense and attack is getting thinner, faster, and more automated.