The internet, as we know it, is held together by glue and dreams. This phrase, coined by Sean O'Kane of TechCrunch, resonated strongly after this week's PHP2Shell vulnerability episode that nearly crippled the web. But the most important news is not the existence of two critical bugs — it's that they had been hidden for decades and were only discovered thanks to a new paradigm of how artificial intelligence interacts with source code.
What happened last week goes far beyond a single bug. It's the symptom of a structural change in how digital infrastructure is built, maintained, and now audited. And the question that arises is not just whether more vulnerabilities will appear — is whether we're prepared to deal with the accelerated pace that AI has imposed on the discovery and exploitation cycle.
The PHP episode
The vulnerabilities CVE-2026-0322 and CVE-2026-0323, found in PHP — the language that powers about 70% of the world's websites — are a paradigmatic case. Both have existed in PHP's source code for decades. The first has been traced back to PHP 4.3, released in 2002. They are real, remotely exploitable flaws that allow arbitrary code execution on vulnerable servers.
The difference from traditional bugs is that the discovery was not made in isolation. It was part of a coordinated initiative by OpenAI and Wiz (acquired by Google) called "Hack the Planet," which involved researchers from several companies working collaboratively. The Wiz team used Google's models, including Gemini 2.5 Pro, to map millions of lines of code and find patterns that had escaped human analysis for years.
The result was devastating. European government websites went offline. Carriers like Japan's SoftBank suspended emergency alert systems. Cloudflare, one of the world's largest web infrastructure providers, reported millions of exploitation attempts in the first hours after disclosure.
But the central point is not that sites went down. It's that when you unravel the fabric of the internet, you discover entire layers of old software holding everything up — code written by teams of a few people, without modern security processes, without dedicated red teams, without budgets to maintain security.
The new frontier: AI-assisted discovery
VulnCheck published impressive data on the emerging trend. Since the beginning of 2026, the number of CVEs disclosed by specific vendors has jumped to unprecedented levels: Chrome saw a 563% increase, VMware rose 180%, Apache grew 170%, Mozilla advanced 156%. GitHub itself confirmed that CVE issuance spiked 476%, with Madison Oliver Ficorilli from the platform's security team explaining that "it's not one person or one tool, it's a systemic shift in how vulnerability discovery is happening."
In April 2026, Anthropic announced Project Glasswing and the Claude Mythos model, which claimed to have identified thousands of zero-day vulnerabilities across all major operating systems and browsers. Rather than releasing the model to the public, the company distributed access to a consortium of partners including AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, Microsoft, NVIDIA, and Palo Alto Networks.
VulnCheck's data show that since then, the volume of AI-assisted discoveries has not slowed. The quality of submissions has improved progressively — what started as "slop" (low-quality submissions in large volume) evolved into serious, verified discoveries. What we're seeing is the first cycle of a wave that will likely only grow.
The paradox: more vulnerabilities, more security?
There is a central paradox in this situation. Matthew Prince, CEO of Cloudflare, compared the phenomenon to "defeating monsters in a haunted house" — it can be frightening, but it's better to know the monsters are in daylight than hidden in the dark. On the other hand, the same phenomenon that allows defensive teams to discover flaws before attackers also means that attackers can discover and exploit vulnerabilities at the same pace.
Daniel Stenberg, lead developer of curl, argued that vulnerabilities discovered by AI tend to be exotic bugs that are difficult to exploit in practice. Ramy Rahman of ArmorCode stated that "more disclosed vulnerabilities don't automatically mean more successful attacks." There is, therefore, an open debate about whether the increase in discovery volume will translate into more real incidents.
What is undeniable is the temporal compression. The gap between discovering a flaw and having exploits available for attackers — which previously gave days or weeks of margin — can now be measured in hours. Shane Fry of RunSafe Security said that the demonstrated performance of AI models over the past few months "has definitively put to rest any doubts about how this will change the industry."
What's next
The internet's infrastructure, built on decades of legacy software and overstretched maintenance, now faces a scenario where vulnerability discovery accelerates exponentially. The question is not whether we will see more incidents like PHP2Shell — it's what kind of security model will emerge to meet this reality.
The answer likely does not lie in trying to prevent AI from discovering flaws, but in building maintenance ecosystems that operate at the same speed. That means automated patching tools, real-time detection systems, and, above all, the understanding that the internet is a living organism whose fundamental parts require continuous investment — not just when there is a crisis, but before.
The haunted house will keep existing. The question is whether we can manage to keep the lights on.
Sources: TechCrunch, Business Standard (Reuters), VulnCheck
✓ Independent sources cross-checked and verified before publishing
