Cloudflare's numbers describe the new mechanics of bug hunting better than any forecast. In the ten hours before PHP2Shell was publicly announced, the network saw thousands of exploit attempts; within 45 minutes of the announcement they became tens of thousands, then hundreds of thousands within two hours, and eventually millions. The sequence does not show a coordinated army arriving, but the vertical collapse of the entry barrier for anyone looking for software flaws.

The PHP vulnerability was found by researchers at Wiz, Calif and OpenAI using LLM-based tools. In the same days, flaws emerged in eMudhra, Node.js, GitLab, Plex, Railway, OpenCode. This is not a rogue AGI: it is confirmation that much of the software holding the internet together has remained vulnerable, outdated or simply forgotten. The structural point is that LLMs turn discovery from an artisanal activity into systematic scanning. If every service is a door, AI makes it possible to turn knobs at scale, even where no human had thought to try.

This acceleration breaks a pillar of security: coordinated disclosure. Chainguard published its own patches before the official announcement, claiming it found the same bugs by asking a frontier model to 'find bad vulnerabilities in PHP'. Amazon said it saw exploit attempts before disclosure. If multiple actors reach the same result in parallel, the so-called Defender's Window shrinks to zero. It is no longer a question of research ethics, but of impossible synchronization between independent discoverers.

The deepest effect, however, is not the number of flaws found, but the imbalance between discovery speed and patching speed. The PHP2Shell story has already pushed governments and agencies to urge immediate patching; services like 4chan, parts of Wikimedia and Archive.org were taken offline for updates. Many historic sites will never be updated and risk disappearing. Link rot is not collateral damage: it is the predictable outcome of an infrastructure where maintenance is slower than discovery.

Dan Guido of Trail of Bits explained that one of his researchers built a working exploit in one day with Codex, but it takes about ten years of system security experience to turn a bug into a shell. That is exactly the point: AI does not abolish expertise, it multiplies it. And it multiplies it on the wrong side for defenders. For those evaluating on-premise deployment, AI-RADAR offers analytical frameworks at /llm-onpremise to weigh these trade-offs. The point is not that cloud is safer, but that stack sovereignty is not enough if the patch cycle does not adapt to the new discovery speed. The attack surface is no longer defined only by what you expose, but by how quickly you can understand whether a door, somewhere, has been found open.