AI tools convert known PHP OOM crash into RCE within 14 days

In October a researcher at Calif leveraged AI tooling to automate the memory layout reasoning required to turn an unexploited crash into arbitrary code execution. The original bug report had sat open since 2024 because it produced only denial-of-service. Two weeks of AI-guided search produced a working exploit chain; Wiz independently confirmed variants. The PHP Foundation then assigned four engineers two months to close the attack surface without breaking existing functionality.

Data from the incident shows the classic defender asymmetry: discovery time collapsed while patch validation time remained constant. Suman Jana at Columbia noted that AI handles the “specific reasoning that is painful to do,” allowing the top 0.1 percent of experts to scale and enabling the tier just below to reach previously inaccessible attack sophistication. Open-source projects without dedicated revenue face sustained pressure because every legacy memory-safety lapse is now a candidate for automated conversion to RCE.

Operationally this accelerates technical-debt repayment across 1990s-era codebases. Maintainers must either adopt formal verification pipelines or accept that previously low-severity crash bugs will be treated as critical. The episode also demonstrates that current AI assistance still requires deep domain knowledge; it amplifies rather than replaces expert auditors.

Next steps include wider deployment of memory-safe language rewrites for PHP extensions and mandatory AI-assisted fuzzing in the PHP release process within the next two major versions.