AI found a bug in the engine behind most of the web. Three AI stories that matter this week
1. PHP2Shell: AI-assisted research finds critical flaws in PHP itself
Wiz Research disclosed PHP2Shell on 21 October, the same day patched PHP releases shipped. The flaws sit in PHP’s core engine, allow unauthenticated remote code execution, and affect nearly every PHP version back to 5.4. Wiz demonstrated attacks against the latest WordPress, Drupal and Joomla images. The researchers say AI models helped them chain the bugs, adapt exploits across versions and validate the fix, and that one researcher did in a week what once took a specialist team months.
Why it matters: AI is compressing the time between a bug existing and a bug being exploited. Patch windows measured in weeks are no longer safe. If you run PHP anywhere, including that forgotten marketing site, patch now, and check whether your CDN or WAF vendor has published a mitigation.
2. AWS says demand is still ahead of capacity
On Amazon’s Q2 call, Andy Jassy said AWS would not have enough capacity to meet all 2026 demand, expected the same in 2027, and described demand already visible for 2028 as striking. Amazon raised its 2026 capital spending plan to about $220 billion, citing memory costs as the main reason.
Why it matters: GPU and memory capacity is now a design constraint, not just a price. Large AI workloads need plans for region choice, reservations and fallback capacity, and portable architectures look more valuable than ever.
3. OpenAI retires GPT-4o and GPT-4.1 from its API on 14 January 2027
The retirement includes GPT-4o mini, GPT-4.1 mini, dated snapshots and fine-tuned models built on them. OpenAI recommends GPT-6 Luna as the replacement, but the switch is more than a model ID change, because reasoning and tool calling behave differently.
Why it matters: Roughly three months is not long for regression testing production prompts and fine-tunes. Teams that keep an evaluation suite and a model abstraction layer will find this a routine change. Teams that hard-coded a model name will not.
Our view
This week’s common thread is speed. Attackers, cloud capacity and model lifecycles are all moving faster than traditional change cycles. Architecture that assumes change (automated patching, portable infrastructure and model-agnostic design) is now the practical choice.