Wiz found a PHP RCE with AI and skipped the number that matters

Wiz says its researchers used three frontier models to chain decade-old memory-safety bugs in core PHP into an unauthenticated remote code execution. The bugs affect PHP back to 5.4 and, by Wiz’s framing, 70% of the web. Two CVEs, severity up to CVSS 9.2, patched and disclosed on 21 October 2026. A single researcher did in a week what Wiz says would have taken a world-class team months. I read the whole write-up twice, and the number I wanted most is missing: how many things Gemini 4 Argon, GPT-5.6 Sol and Wiz Atlas flagged that turned out to be nothing.

I think that missing figure decides how impressed anyone should be. A tool that surfaces one real pre-auth RCE on its own is extraordinary. A tool that surfaces one real pre-auth RCE buried in a heap of confident-sounding false alarms is an expensive triage queue with a press release attached. You cannot tell which you are looking at from the Wiz post, because it reports the hits and stays quiet on the misses. Wiz’s own announcement thread doesn’t give a total count of findings either.

We have seen what the misses look like when people publish them. When Sean Heelan tested OpenAI’s o3 against a known ksmbd bug in the Linux kernel in May 2025, he got the real bug in roughly 8 of 100 runs and about 28 false positives, and he put the signal-to-noise ratio on the larger sample at around 1:50. He still found a genuine zero-day, CVE-2025-37899, and I rate that work highly precisely because he told us the denominator. Fifty wrong guesses for one right one is a result a security team can staff and budget around.

The cost of those wrong guesses lands on real people. Daniel Stenberg, who leads curl, said in May 2025 that the project was “effectively being DDoSed” by AI-generated bug reports, that he had never seen a valid AI-assisted one, and that he would ban reporters sending slop. Every false positive a model emits is work for a maintainer who is often unpaid. If frontier models are going to be pointed at shared infrastructure like PHP, their wrong answers end up on the desks of the same small teams Stenberg speaks for.

Some firms do show the full ledger. XBOW’s own breakdown of its climb to the top of HackerOne’s US leaderboard in June 2025 listed roughly 1,060 submissions with about 130 resolved and about 300 triaged, the rest duplicate, informative, not applicable or pending. That is how I would want to read any AI bug-hunter: real fixes over total submissions. DARPA’s AI Cyber Challenge final at DEF CON in August 2025 reported that competing systems found 54 of 70 synthetic vulnerabilities and patched 43, and separately turned up 18 real unknown bugs. Both gave readers a rate they could compare. OpenAI’s Aardvark, announced in October 2025, quoted 92% recall on golden test repositories and bugs that received 10 CVEs, and said nothing about its false-positive rate, which is the half of the measurement that tells you whether 92% recall is cheap or ruinous.

There is a fair reply to all this. Google says every Big Sleep report is checked by a human before it is filed, and that process held up through the SQLite findings. If a person verifies each candidate before it reaches the PHP security team, maintainers never see the junk, so why should outsiders care how much the model produced along the way. I care because Wiz’s central claim is economic. The post argues that AI changes the economics of discovery and exploitation. You cannot assert a change in economics and then withhold the cost side. The hours a researcher spent dismissing bad candidates are the actual price of the four exploitable bugs Wiz wrote up, and an attacker weighing the same tooling is doing that arithmetic too. A week of one researcher’s time sounds cheap; I would like to know how much of that week went on discarding nonsense.

Wiz thanks OpenAI, Calif and the PHP team for discovery, coordination and patch verification, and says all three published their own write-ups. Open those posts and look for one figure: how many candidates the models raised in total before the two CVEs, and what share were false. If none of the four organisations involved prints it by the end of 2026, I will treat every claim of an AI inflection point in vulnerability hunting made this year as marketing until someone does.

Prompted by PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog, wiz.io.