In late October, researchers at cybersecurity firm Calif, sponsored by OpenAI, discovered the PHP2Shell vulnerability — a critical flaw in PHP, the 1994-era language powering WordPress, Drupal, and sites including NASA, Wikipedia, and the White House. The root cause, an out-of-memory error reported in 2024, was long dismissed as a mere crash risk. Using AI tools, a Calif researcher transformed this bug into a remote code execution exploit within two weeks, enabling arbitrary code execution and data theft. Exploitation required precise memory manipulation — overwriting specific bits in a calculated order to hijack control flow — a task Columbia University's Suman Jana describes as "very specific reasoning that is painful to do," which AI now handles effectively. Jana emphasizes AI augments, not replaces, experts: the top 0.1% achieve more, while near-experts bypass deep nitty-gritty details. Patching took four engineers two months, highlighting the asymmetry between finding and fixing bugs; defenders must close all attack paths without breaking functionality. Jana advocates increased funding for open-source maintenance and frontier AI model access, noting formal verification advances — including Anthropic's October 22 release where LLMs generate patches and proofs, verified by a formal checker to prevent hallucinations. Johns Hopkins' Matthew Green remains skeptical, predicting action only after a catastrophic event, possibly in early 2027. Both agree PHP2Shell signals more AI-discovered vulnerabilities ahead, urging immediate software updates.