Artificial intelligence has earned plenty of troubling headlines: jobs threatened, personal information compromised, and machines acquiring capabilities their creators struggle to control. Those concerns deserve serious attention.

But this week, AI gave Americans a reason to be grateful.

On October 21, the PHP Foundation rushed out emergency fixes for critical weaknesses that AI had helped uncover in software supporting much of the world’s internet. The vulnerabilities could have let criminals seize websites, steal data, and disrupt services millions depend on.

Researchers identified the danger in August and spent the next two months preparing defenses with software developers and security companies. The plan did not hold. Details leaked on October 20, forcing the fixes out a day early.

Still, here was artificial intelligence doing something genuinely valuable: exposing a threat that had escaped years of scrutiny. That deserves recognition, especially from those of us who have warned about AI’s dangers. Yet the same technology that helps protect the internet can also help criminals attack it.

A Threat Hidden in Plain Sight

The vulnerabilities, known collectively as PHP2Shell, affected PHP, a programming language used by approximately 70% of the world’s websites. PHP runs popular platforms such as WordPress and Drupal.

According to Wiz Research’s October 21 report, the underlying weaknesses had existed in PHP for more than a decade. AI helped researchers overcome the complexity that had long hidden them, showing how attackers could seize vulnerable servers without a password. Wiz ranked the findings among the most severe vulnerabilities ever discovered in PHP.

Businesses, hospitals, churches, charities, and government agencies all depend on such websites. Not every PHP site was vulnerable, and 70% of the internet was not about to collapse. But the potential consequences were enormous.

Cybersecurity companies Calif and Wiz independently uncovered the flaws using advanced AI models. Calif employed OpenAI’s GPT-5.6 Sol. Wiz, now owned by Google, used both GPT-5.6 Sol and Google’s Gemini 4 Argon.

The researchers reported that AI let one investigator accomplish in about a week what once required a team working for months.

When AI Serves the Public Good

Discovering the vulnerabilities was a major achievement. Protecting the public required something AI could not accomplish alone.

OpenAI reported that it helped lead a two-month effort involving researchers, software developers, infrastructure providers, and government agencies, among them the White House’s Super Intelligence Force and the Cybersecurity and Infrastructure Security Agency. PHP’s maintainers developed and released the fixes.

Cloudflare reported that it deployed protections about nine hours before the public announcement and detected attack traffic once details leaked.

Government cybersecurity authorities warned website operators to install the fixes immediately or, failing that, take vulnerable sites offline. Britain, Finland, and Japan pulled portions of government websites offline as a precaution.

Small businesses, ministries, nonprofits, and ordinary Americans depend on systems they neither designed nor fully understand, much of it open-source code maintained by volunteers. Protecting those systems serves the common good.

The Same Capability in the Wrong Hands

The technology that helped identify these weaknesses has no moral judgment of its own. In the hands of skilled researchers, AI can help protect millions of innocent people. In the hands of criminals or hostile foreign intelligence services, the same capabilities can accelerate attacks on financial networks, public utilities, communications systems, and other essential infrastructure.

OpenAI acknowledged as much, warning that “the same capabilities can also help attackers rapidly develop offensive tools and exploits.” The PHP Foundation went further: “Tools now find bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing.”

The danger was no longer hypothetical. Amazon reported that someone attempted to exploit PHP2Shell on October 17, four days before the vulnerabilities became public. Amazon could not establish how the attacker obtained the information or whether the attempt would have succeeded. The lesson is plain. Defenders cannot assume they will find dangerous weaknesses before their adversaries, and AI is closing the gap between discovery and exploitation.

The concerns reach beyond cybersecurity research. On October 22, Axios reported that major American banks, including JPMorgan, Bank of America, and Wells Fargo, are detecting unauthorized third-party AI agents inside customer accounts, some attempting actions that appear independent of user instructions. They raise the same question: Who controls powerful AI systems, and who bears responsibility when their actions threaten others?

Through it all, AI did not replace experienced professionals. The PHP2Shell response required engineers, security specialists, corporate leaders, and public officials to decide when to disclose, how to distribute fixes, and how to protect vulnerable systems. Even Calif conceded that “current models do not reliably start from obscure, twenty-year-old primitives on their own.”

AI assisted the discovery. Human beings remained responsible for the response.

Technology Still Requires Wisdom

As a Christian, I see no reason to regard scientific discovery or technological innovation as inherently threatening. Human creativity, reason, and problem-solving are gifts from a Creator who made us in His image, and they can be directed toward worthwhile purposes.

But possessing a powerful capability does not justify every possible use. Scripture teaches, “Do not withhold good from those to whom it is due, when it is in your power to do it” (Proverbs 3:27, ESV). When a technology can help protect human life, safeguard property, or prevent widespread harm, its constructive use deserves encouragement.

Yet human ingenuity does not erase human fallenness. “The heart is deceitful above all things,” the prophet warns (Jeremiah 17:9, ESV). The tools we create can serve generosity or greed, protection or exploitation, truth or deception. That is why PHP2Shell should prompt neither uncritical enthusiasm nor reflexive opposition to artificial intelligence, but responsible stewardship.

Technology companies must develop effective safeguards. Governments must protect essential infrastructure, and cybersecurity researchers must coordinate the discovery and correction of dangerous vulnerabilities. Website owners, including churches and ministries, should ensure their systems are patched. These responsibilities cannot be handed to machines.

PHP2Shell shows what artificial intelligence can accomplish for good. It also shows how quickly that same capability can become dangerous in the wrong hands.

AI does not change human nature. It gives human beings greater power to express it, for good or evil. Our responsibility is to ensure that wisdom and moral judgment govern the technology, rather than allowing technological power to govern us.