PHP2Shell: AI found a 14-year-old bug in 70% of the internet

Two critical remote code execution flaws in PHP sat quietly in the open-source codebase for over a decade. Last month, AI found them in a matter of days. Millions of exploitation attempts followed within hours. That is the headline, and it is the least interesting part of what happened. The interesting part is that the human beings who found the bug — professional security researchers at OpenAI, Google-owned Wiz, and a small California firm called Calif — did almost everything right. They found