Recently, PHP has been found to harbor two critical remote code execution vulnerabilities that have gone undetected for 14 years, with a severity score reaching as high as 9.2. Attackers can remotely seize control of servers simply by sending a request, without the need to log in. These vulnerabilities have a broad impact, affecting approximately 70% of websites worldwide. The discovery of these flaws was aided by AI tools, including GPT-5.6 Sol. Initially, the relevant parties intended to patch these vulnerabilities discreetly over a two-month period. However, due to the public release of the vulnerability identifiers, the leak of attack demonstration videos, and the premature distribution of build images containing the fixes, attacks commenced before the official patch could be deployed.

AI technology has not only lowered the barrier to identifying vulnerabilities but also accelerated the pace of vulnerability detection. Nevertheless, vulnerability remediation faces hurdles such as version compatibility issues, the maintenance of legacy systems, and inadequate resources for sustaining open-source ecosystems. The progress of repairs significantly lags behind the speed at which vulnerabilities are discovered, highlighting a significant disparity between vulnerability discovery and remediation capabilities in the realm of internet security during the AI era.