Evidence at a glance
Based on the linked sources. The author's reported result and independent confirmation are separate checks.
- AI involvement
- Reported models: GPT-5.6 Sol, Gemini. Tools not reported. The writeup below describes the work attributed to AI.
- Reported result
- Research. This is the directory's source-based outcome classification.
- Independent confirmation
- Not reported.
- Human work and limitations
- The entry focuses on the PHP2Shell incident as documented in the provided source. Other vulnerabilities mentioned in the source (eMudhra, Railway, GitLab) are noted as having different or unknown relationships to AI-assisted discovery.
Original sources
What was done
Security researchers utilized frontier AI models to identify and develop exploits for critical PHP remote code execution vulnerabilities, significantly accelerating the timeline from patch announcement to active exploitation.
In October 2026, security teams from Calif and Wiz identified two critical Remote Code Execution (RCE) vulnerabilities in PHP, designated as CVE-2026-109618 and CVE-2026-109619, collectively marketed as "PHP2Shell." According to Drew's Dev Blog, these teams employed frontier AI models, specifically GPT-5.6 Sol and Gemini 4 Argon, to discover the vulnerabilities and construct functional exploits. One of the vulnerabilities, CVE-2026-109618, had been previously identified during a 2024 security audit but remained unpatched due to disagreements regarding the fix and the perceived difficulty of creating an exploit. The author reports that LLMs are effective at transforming theoretical vulnerabilities into actionable exploits. This capability has reduced the window between security patch announcements and the distribution of functional exploits to hours or minutes. While some critics argue that AI-generated exploits often rely on flawed assumptions or produce "exploit slop," the author notes that the presence of even a single functional exploit among many non-working ones poses a significant threat. The vulnerability is estimated to affect approximately 70% of the internet.