tl;dr: AI-assisted auditors at Calif (sponsored by OpenAI) turned a long-ignored PHP out-of-memory crash bug into a critical RCE vulnerability dubbed PHP2Shell, affecting sites running WordPress, Drupal, and others. The incident highlights how AI is making it feasible to exploit decades of accumulated legacy bugs that were previously too tedious to weaponize, creating an asymmetric burden on open-source maintainers. Researchers hope LLM-generated patches paired with formal verification (like Anthropic's recent release) can help defenders keep pace, but some expect no serious investment until a truly catastrophic breach occurs.