The Internet Cicada

A periodical cicada can spend more than a decade underground before it suddenly appears. For years, almost nothing on the surface suggests what is there. Then the conditions change, the ground opens, and something that had been present all along becomes impossible to ignore.

Software vulnerabilities can behave in a strangely similar way.

On October 21, researchers disclosed two critical vulnerabilities in PHP, the programming language underneath a large part of the modern web. Collectively named PHP2Shell, the flaws could allow an unauthenticated attacker to execute code remotely on affected servers or expose sensitive information from memory. PHP released emergency patches the same day. Within days, researchers were reporting successful exploitation in the wild.

The surprising part was not simply that PHP contained a serious vulnerability. Large, mature software projects occasionally do. What made PHP2Shell remarkable was how long the underlying weaknesses had been there — and what finally made them practically exploitable.

According to Wiz, some of the vulnerable code had survived for more than a decade. The flaws involved obscure interactions in the way PHP handled memory after certain errors. Researchers could see pieces of the problem, but turning those pieces into a reliable attack required an exceptionally complicated chain of reasoning, testing and adaptation across different configurations. Complexity had effectively acted as a barrier. The vulnerability existed, but exploiting it was difficult enough that it remained largely dormant.

Then the tools changed.

When complexity stops being protection

Wiz, OpenAI and independent security researchers used frontier AI models during the investigation. Wiz says AI materially helped with vulnerability discovery, exploit development, attack detection and validation of the eventual patch. OpenAI separately reported that researcher Calif identified a critical PHP flaw using GPT-5.6 Sol, while Wiz independently discovered and reported both vulnerabilities.

That distinction matters. AI did not magically create a weakness that had not existed before. It changed the amount of effort required to understand one that was already there.

The exploitation problem was unusually difficult because success depended on understanding how PHP allocated and reused memory across requests, then adapting the attack to different versions, configurations and applications. Before the current generation of AI tools, that work might have demanded months from an unusually skilled team. Wiz says researchers using frontier models were able to develop and adapt working exploits across multiple applications in hours, and described the broader research effort as reducing work that might previously have required a world-class team for months to something a single researcher could accomplish far more quickly.

That is the larger story behind PHP2Shell.

For a long time, one of software security's quiet assumptions was that some vulnerabilities were protected by their own complexity. A weakness might technically exist, but finding it, understanding it and turning it into a practical exploit required so much specialized knowledge and time that relatively few people could do it.

AI is beginning to erode that protection.

It can read enormous quantities of code, compare patterns, generate hypotheses, help reproduce failures and continue iterating when one approach fails. A skilled researcher still has to understand what matters and direct the investigation, but the amount of territory one person can cover is changing dramatically.

That has consequences far beyond PHP.

The vulnerability was there yesterday

The uncomfortable lesson of PHP2Shell is that software does not become vulnerable when somebody discovers the flaw. It was vulnerable the day before as well.

Discovery changes what we know about the risk, not when the risk began.

This sounds obvious, but it has important consequences for how we think about mature software. Longevity creates confidence. If millions of people have used a technology for years without a catastrophic failure, we naturally begin to treat that history as evidence of security.

Usually it is useful evidence. Widely used software is exposed to enormous amounts of testing, debugging and scrutiny.

But it is not proof.

PHP2Shell demonstrates why. Code can survive years of human attention while still containing a weakness that remains impractical to exploit because the final steps are simply too difficult. Change the analytical tools, however, and yesterday's impractical vulnerability can become today's usable attack.

That is what makes this moment particularly important. The software did not suddenly change.

Our ability to interrogate it did.

And that ability is improving very quickly.

The same tool works both ways

There is an obvious temptation to tell this story as another warning about dangerous AI.

That would miss half of what happened.

AI helped uncover the vulnerabilities before disclosure. It helped researchers understand how they could be exploited. It also helped validate the fixes and gave defenders time to coordinate patches, detections and mitigations across an enormous ecosystem of hosting providers, cloud platforms and security companies. OpenAI described the operation as a coordinated effort involving PHP maintainers, Wiz, Cloudflare and others to prepare protections before the vulnerabilities became public.

This is the paradox at the heart of AI-assisted security.

The same technology that lowers the cost of finding weaknesses also lowers the cost of finding them before an attacker does.

That is an extraordinary opportunity. Codebases containing millions of lines can be revisited with analytical capabilities that did not exist when much of that software was written. Old assumptions can be tested again. Strange edge cases that once received little attention can be explored systematically. Software that has been running for years can effectively receive another generation of scrutiny.

But there is no reason to assume defenders will always arrive first.

Reports emerged that malicious activity targeting PHP2Shell began even before the coordinated public release, after details about the vulnerabilities leaked. Confirmed successful exploitation was subsequently observed in the wild.

The race has therefore changed on both sides.

Why this matters especially for smart contracts

PHP2Shell concerns web infrastructure, not blockchain. Yet the lesson becomes even more interesting when software directly controls financial assets.

A smart contract can determine who owns something, when funds move, who has privileged permissions, whether additional tokens can be issued, whether a transaction can be paused and under what conditions an agreement executes. The code is not simply supporting the transaction. In many cases, the code is part of the transaction.

That creates an unusual security environment.

Much smart-contract code is publicly visible, which is one of blockchain's strengths. Anyone can examine the rules rather than simply trusting the organization operating them. But transparency works in both directions. The same contract available to an investor, developer or auditor is also available to someone searching for a weakness.

Until now, the difficulty of analysing thousands of contracts created its own practical limitation. Human researchers have finite time. Attackers had to decide which projects justified serious attention.

Machine-scale analysis begins to remove some of that constraint.

An AI system does not need to discover a completely new class of vulnerability every day to change the economics. If it can inspect enormous numbers of contracts, identify unusual patterns and reduce thousands of possible targets to a few worth deeper investigation, it has already changed the attack surface.

This is exactly why security cannot remain static while the technology challenging it becomes more capable.

Security after the cicada

There is a reassuring side to the PHP2Shell story.

The vulnerability was found. Researchers coordinated with maintainers. Patches were prepared. Infrastructure providers were warned. Defensive tools were updated. A weakness that had remained underground for years was finally brought into the open.

But it would be a mistake to treat this as an isolated success.

There are vast amounts of software in the world that were written under very different assumptions about who would examine them and what tools those people would have. Some of that code runs websites. Some moves money. Some manages identity, infrastructure or access to critical services.

AI gives us a chance to revisit that software with capabilities its original authors could never have anticipated.

At SentaTrust, this is closely connected to how we think about smart-contract verification. The objective cannot simply be to run yesterday's security process faster. Verification itself has to evolve. Machines are extraordinarily good at systematic analysis, repetition and scale. Humans remain essential for understanding business logic, economic consequences, permissions, incentives and whether technically valid behaviour actually matches what a system was intended to do.

The strongest approach combines both.

PHP2Shell is therefore interesting not simply because AI helped find an important vulnerability. It shows us what happens when the barrier protecting a dormant weakness is no longer the weakness itself, but the difficulty of discovering and exploiting it.

There may be many more such vulnerabilities waiting quietly inside the software we already depend on.

Like the cicada, they do not need to be new.

They only need the right conditions to emerge.

And those conditions are changing.

Read more Insights — and follow us on LinkedIn and X for new articles as they are published.