Last week something happened that a few years ago would have sounded like a science fiction script, and it passed almost without anyone noticing what it meant. AI models, in the hands of security researchers, found two critical vulnerabilities in PHP, the programming language that runs a huge share of the web. The flaws, named PHP2Shell, allow code to be run on a remote server without a password. Emergency patches were released, administrators rushed to update, and the world moved on.
But it is worth pausing. The real story here is not another flaw and another patch. The story is that AI has become an excellent tool for finding security vulnerabilities, and that changes the rules of the game in cybersecurity. The important question is no longer who will find the next hole. It is who will fix it, and how fast.
The machine does not get tired
For decades, finding vulnerabilities was the work of a small number of experts. A good security researcher can spend weeks on a single piece of code, trying directions, getting stuck and starting over. An advanced language model does not get tired or bored, and can explore thousands of paths in parallel. In the case of PHP2Shell, according to reports, researchers at Wiz and Calif used models from OpenAI and Google to find problems in code that had already been reviewed countless times.
That is good news. Every vulnerability found by responsible researchers and reported to developers is one an attacker will not exploit quietly. But we have to be honest: the same tools are available to the other side. If a model can help a researcher at Wiz, it can help a well-funded attack group too. And the most troubling detail of this affair is that an exploitation attempt was recorded four days before the official disclosure. Someone knew, or found it on their own, before the fix was available to everyone.
The bottleneck has moved
This is the point the industry has not yet absorbed. For years, the bottleneck in security was discovery: vulnerabilities sat in code for years because no one found them. Now discovery is becoming cheap and fast, and the bottleneck is moving to the other side, to the fix.
And fixing is a human process, slow and cumbersome. The average organization does not know exactly where every version of every piece of software is running. There are forgotten servers, containers built from three-year-old base images, hosting providers who update at their own pace, and critical systems no one dares touch in the middle of the quarter. According to the PHP2Shell summaries, PHP 8.1 and older will get no official fix at all. Anyone still running them, and that is quite a few sites, stays exposed until they upgrade.
When models find ten critical vulnerabilities a month instead of one, that gap will become a chasm. It will not help to find every hole within hours if security updates keep taking months to install.
And this is not only a technical problem, it is a problem of priorities. In the same week administrators were rushing to update servers, Meta announced it would raise up to $95 billion to build more AI infrastructure. The industry is willing to invest fantastic sums to make models smarter. I am not sure it is willing to invest even a fraction of that to keep the software we all rely on up to date. Open-source libraries that hold up half the internet are often maintained by a handful of volunteers, and they are now receiving vulnerability reports at a pace no small team can keep up with.
What needs to happen now
First, organizations need to treat security updates as infrastructure, not as a task pushed to the end of the week. You cannot update what you do not know you are running. A full inventory of software and versions is no longer a luxury, it is a basic requirement.
Second, the same AI that finds holes should help fix them. If a model can explain why a piece of code is vulnerable, it can also propose a fix, test it and prepare it for deployment. Investment in AI security tools cannot focus only on the offensive and research side. The big money should go into automating the fix.
Third, we need to rethink old software. A version that is no longer supported does not "still work". It is an open tab that someone will eventually collect on.
And fourth, regulators have a role too. The rules of responsible disclosure were written for a world in which finding a vulnerability was a rare event. When discovery becomes an automated industry, we need to set again how long developers get to fix, who funds fixes in open-source projects, and what obligation hosting and cloud providers have to update their customers, not just publish a notice and hope for the best.
Israel, with its strong cybersecurity industry, has a real opportunity here. The companies that manage to close the gap between discovery and fix, not just discover faster, will define the next generation of security. We have the talent, the military and civilian experience and the culture of building security products. What is missing is the understanding that the next cybersecurity market is not another tool that warns about problems, but a tool that solves them.
AI has already won the race to find the holes. The race still open is the race to close them, and in that race we are still on foot.
