A look at OpenAI's Project Daybreak, which lets vetted partners use its top hacking models to find and fix vulnerabilities and helped uncover PHP2Shell RCE bugs

AI models now trivially find critical software vulnerabilities, overwhelming volunteer maintainers and exposing millions of websites.

OpenAI's Project Daybreak, a program that offers vetted partners access to its advanced AI models for cybersecurity, recently helped uncover critical Remote Code Execution (RCE) vulnerabilities in PHP. These PHP2Shell vulnerabilities, discovered through AI-driven analysis, could have allowed attackers to take over websites, steal data, and launch malware. Initially discovered and deprioritized by PHP maintainers due to lack of exploitability evidence, the vulnerabilities were re-identified by researchers using OpenAI and Anthropic models. The severity led to a coordinated disclosure attempt, but leaks and an early patch release by Chainguard caused a scramble for system administrators. Over 33 million websites remain vulnerable, highlighting the fragility of open-source software maintenance in the face of AI-powered vulnerability discovery.

The rapid discovery of severe vulnerabilities in widely used open-source software like PHP, facilitated by advanced AI models, signals a paradigm shift in cybersecurity. Previously, finding zero-day exploits required specialized knowledge and significant resources, but AI models can now identify them with simple prompts. This acceleration in vulnerability discovery, coupled with the under-resourced nature of most open-source projects maintained by volunteers, creates a significant security challenge. The current situation with PHP2Shell underscores the potential for widespread disruption when these powerful tools fall into the wrong hands or are inadequately managed by the core software maintainers.

This event highlights the urgent need for increased corporate funding and support for open-source projects that form the internet's backbone. As AI lowers the barrier to exploit discovery, the burden on volunteer maintainers will only grow, increasing the risk of burnout and critical security gaps. The incident serves as a stark warning that the current model of relying on goodwill for essential software maintenance is unsustainable, especially with sophisticated AI tools capable of discovering and weaponizing vulnerabilities at an unprecedented scale.