AI-led bug hunting creates a triage bottleneck for open-source maintainers

The PHP2Shell discovery

OpenAI recently announced that its GPT-5.6 Sol model helped identify two severe security vulnerabilities in PHP, a server-side language used by a large portion of the internet. These flaws, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), affected the memory and error-handling code used during standard web requests. An unauthenticated attacker could potentially corrupt memory or run their own code on a server under specific conditions.

The discovery was a collaborative effort involving several entities, including Calif.io, Wiz, Quarkslab, and the PHP Foundation's own security team. While OpenAI highlighted the event as evidence that frontier AI can spot security holes before hackers do, the timeline shows a complex web of independent reports. Calif.io submitted the first report in August, followed by Wiz in late August, and OpenAI reported the same root cause in September.

The patches for these vulnerabilities were eventually released on October 21 across several PHP versions. This release occurred one day earlier than planned because security identifiers began leaking on social media and forums. The PHP Foundation had to shift to an emergency schedule to address the leak and the fact that the flaws were being discussed publicly before the official fix was ready.

The cost of human maintenance

While AI models are becoming highly efficient at scanning code for weaknesses, the actual work of fixing those bugs remains a manual human process. The PHP Foundation noted that since July 1, their security team has had to work through more than 100 reports that were either invalid, duplicates, or could not be reproduced. This indicates that while AI can find potential issues, it often generates a high volume of noise that requires human intervention to filter out.

Fixing the PHP2Shell flaws was particularly difficult because the code was executed on nearly every request. The development team had to balance backward compatibility, risks of denial-of-service attacks, and the needs of third-party extensions. Because the fix was complex, the PHP Foundation stated they could not have completed the work without people working full-time and through weekends without specific funding.

Industry experts point out that the economics of software maintenance are shifting. Finding a flaw is becoming cheaper and faster, but proving a flaw is real and writing a fix that does not break existing software is still expensive. This creates a situation where the bill for security is being moved from the discoverer to the volunteer maintainers who must handle the fallout of these automated reports.

A growing triage bottleneck

Security engineers warn that the primary bottleneck in cybersecurity is no longer simply finding flaws but validating them. AI-led bug hunting can surface weaknesses at a scale that manual review cannot match, but every finding still requires an impact assessment and regression testing. For small projects run by volunteers, this influx of AI-generated reports can lead to a backlog where some issues might fall through the cracks because they cannot be processed in time.

The PHP2Shell incident serves as a case study for how quickly disclosure can become a problem when information spreads before maintainers are ready. Because the CVE IDs leaked early, the PHP Foundation faced immense pressure to organize a fix and announcement quickly. Experts suggest that if AI systems continue to surface flaws at a much higher rate, maintainers will spend less time hunting for bugs and more time triaging and coordinating releases under intense pressure.

There is also a concern regarding the shrinking window of time available to respond to these threats. When AI speeds up the discovery phase, the time between a bug being found and it being exploited by a malicious actor decreases. If the human-led maintenance process does not scale at the same pace as AI discovery, the software community faces a risk of vulnerability fatigue, where teams become overwhelmed by the sheer volume of urgent advisories.

Moving toward resilience

To manage this new reality, security leaders are suggesting a shift in how organizations approach their software architecture. Rather than just trying to patch every new CVE as fast as possible, companies should focus on fundamentals that make vulnerabilities less impactful. This includes implementing stronger segmentation, reducing the overall attack surface, and enforcing the principle of least privilege to limit what an attacker can do if they succeed.

Experts also argue that the responsibility for AI-led discovery should include more than just sending a bug report. They suggest that organizations developing AI discovery tools should provide reproducible test cases, human researchers to answer questions, and even funding for the triage process. If the goal is to improve security, the discovery process must be paired with a mechanism to support the unglamorous work of patching and testing that currently falls on volunteers.

The PHP Foundation spent $784,376 last year to fund 11 developers, illustrating the limited resources available for maintaining critical infrastructure. As AI continues to find flaws in code that has been around for decades, the community must find ways to fund and staff the triage process. Without a way to scale maintenance alongside discovery, the growing backlog of reports could become a significant security risk for the web.