EU AI Watch: AI Found the PHP Bug—Now Europe Must Fix the Software It Reveals

A bug first reported in 2024 could have crashed a website. AI-assisted auditing turned it into something much worse: a path to running malicious code and reading sensitive data on the server. The so-called PHP2Shell vulnerability put numerous sites—including NASA, Wikipedia and the White House—on alert, alongside websites running WordPress or Drupal.

Good news first: researchers found the flaw, reported it to the PHP Foundation, and a patch shipped before attackers reportedly got the exploit. So this is not a breach story. It is a near-miss story—and that is precisely why European leaders should pay attention.

IEEE Spectrum reports that the underlying issue was an out-of-memory error in PHP, a language created in 1994 and still heavily used by legacy sites. Ordinarily, that kind of bug causes a crash. It does not automatically create a security emergency. But earlier this year, the cybersecurity firm Calif, in an audit sponsored by OpenAI, used AI tools to find a way to turn the error into arbitrary code execution. The researcher’s finding changed a nuisance bug into a critical vulnerability and prompted the patch.

Matt Suiche, AI security research lead at Tolmo, frames the wider issue bluntly: AI is exposing technical debt accumulated across roughly 40 years of software built by humans. Columbia University associate professor Suman Jana says AI has been especially useful for the painstaking, highly specific reasoning required to investigate bug reports that otherwise tend to sit untreated because they look like crashes.

This lands in Europe just as the EU AI Act becomes operational rather than theoretical. The Act has been applicable since 2 August 2026, with enforcement powers for the AI Office and national authorities active now. Its prohibitions and AI-literacy requirements have applied since February 2025, while governance rules and general-purpose AI obligations have applied since August 2025. Transparency duties under Article 50 also became applicable in August.

For European AI companies, the lesson is not merely to add an “AI-powered” label to a security product and hope the label does the work. The hard part is demonstrating that the tool helps identify and fix vulnerabilities without introducing new risks. That raises practical questions about testing, documentation, human oversight and the handling of potentially sensitive system data. The source does not provide enough detail to classify particular AI security systems under the Act, so pretending otherwise would be regulation cosplay.

GDPR matters too. If AI-assisted audits or automated processes touch personal data, data-protection obligations remain with organisations and are enforced by national DPAs. Fixing infrastructure bugs does not erase privacy duties.

The report does not identify particular affected EU sites, and there is no reported mass exploitation. What it does reveal is a broader problem: AI is accelerating discovery of weaknesses in software Europe spent years leaving untouched.

What this means

Europe should treat AI-assisted cybersecurity as an opportunity to reduce decades of technical debt, not as permission to automate risk. The winners will not simply be the companies producing the flashiest AI security tools; they will be those that can show, with evidence, how those tools behave in real deployments, how personal data is protected, and who remains responsible when something goes wrong.

The EU AI Act can provide guardrails, but it cannot patch ageing code or manufacture institutional trust. That still requires engineers, funded maintenance and organisations willing to treat a crash report as something more than background noise.

One-sentence takeaway: AI can now expose the software debt hiding inside Europe’s digital infrastructure, but turning that discovery into safety will require regulation, privacy discipline and the unglamorous work of actually fixing the code.

Source: AI is forcing us to pay off 40 years of technical debt — 1150 points on Hacker News