For years, some of the web’s most dangerous security vulnerabilities have remained hidden simply because finding and exploiting them was too difficult.

AI is starting to change that.

This week, researchers revealed two critical security flaws in PHP, the programming language behind roughly 70% of the world’s websites. The flaws had existed for more than a decade. But advanced AI tools helped researchers from Wiz, OpenAI, and Calif (working with PHP’s security team) figure out how to exploit them. 

The discovery triggered an international scramble to secure websites, with governments and major businesses temporarily shutting down online services as a precaution.

According to Cloudflare, hackers launched tens of thousands of attempted attacks within 45 minutes of the public announcement. That number climbed into the millions by the following evening.

The incident raises an important question: What happens to the cybersecurity industry when AI makes sophisticated hacking dramatically easier?

For investors, the answer could mean a major new wave of cybersecurity spending.

How AI uncovered a decade-old security threat

First, let’s look at what actually happened.

PHP is a programming language that runs behind the scenes on websites, including WordPress blogs, online stores, and government portals. When you click a link, PHP often helps generate the page you see.

The two flaws, collectively nicknamed “PHP2Shell,” can let hackers run commands directly on vulnerable website servers without a password. An attacker could potentially take control of a server, steal sensitive information, install malicious software, or take a website offline.

The flaws received a severity rating as high as 9.2 out of 10.

The underlying weaknesses had existed since PHP versions released more than a decade ago. But before AI, exploiting them was extraordinarily complicated.

According to cybersecurity firm Wiz, turning the flaws into working attacks required multiple steps, extensive testing, and a deep understanding of how the software manages computer memory.

Historically, that kind of work would have required highly specialized researchers and substantial time.

But advanced AI models helped researchers uncover and exploit vulnerabilities across several popular website platforms in hours.

Simply put, AI is making vulnerabilities that were once extremely difficult to exploit much more accessible. And while that’s good news when security researchers find these weaknesses first, the same capabilities could give hackers a powerful advantage.

Bear in mind, finding a security weakness is only half the battle. Once it’s discovered, the affected software needs to be patched. But companies can’t always install those updates immediately.

Major businesses must identify vulnerable systems, test fixes, and coordinate updates without disrupting operations. Smaller companies may rely on outside providers or lack dedicated IT teams altogether.

Meanwhile, hackers can begin targeting exposed systems as soon as they have a working exploit.

That creates a dangerous imbalance: AI is helping attackers move faster, while businesses still need time to secure their systems.

And as AI becomes more capable, that gap could become increasingly difficult to manage.

Why cybersecurity companies stand to benefit

As cyberattacks become faster and more sophisticated, businesses will need ways to protect themselves while their IT teams work on permanent fixes. Cybersecurity companies that can meet that need are well positioned to benefit.

Take Cloudflare (NET), which helps protect websites and applications by filtering internet traffic and blocking suspicious activity before it reaches a customer’s servers.

During the PHP2Shell incident, the company deployed protective firewall rules for customers across its free and paid plans.

Those protections gave customers an additional line of defense against known attack methods, even if they hadn’t yet installed the PHP software updates.

Instead of every business scrambling to develop its own defenses against a newly discovered threat, Cloudflare can create protections and deploy them across its network.

And because Cloudflare already handles traffic for millions of websites, it can distribute those protections at enormous scale.

That gives customers a compelling reason to use its services, especially as the time between discovering a vulnerability and seeing attempted attacks continues to shrink.

Other cybersecurity companies are positioned to benefit from the broader trend.

For example, CrowdStrike (CRWD) helps organizations detect and respond to suspicious activity across their computers and systems.

Palo Alto Networks (PANW) provides tools to secure corporate networks, cloud infrastructure, and security operations.

And Zscaler (ZS) helps businesses control and protect access to their applications and networks.

These companies offer different services, but they address a common problem: Businesses need to identify and stop threats before those threats cause serious damage.

When a cyberattack can steal customer information, disrupt operations, and cost millions of dollars, protection becomes an increasingly important business expense.

Wall Street appears to recognize the opportunity.

On Wednesday, Cloudflare, CrowdStrike, Zscaler, and Okta all posted strong gains, as investors weighed the potential implications of the PHP2Shell scare.

What investors should watch

There’s another important factor to consider: AI is also making cybersecurity companies more capable.

The same technology that helps hackers find vulnerabilities can help defenders discover weaknesses, identify threats, and develop protections faster.

In fact, that’s exactly how this week’s incident began—with AI helping security researchers uncover flaws that had gone unnoticed for years.

Over time, these tools could make certain cybersecurity services cheaper and easier to deliver, creating more competition for established providers.

So while AI-driven threats could fuel higher cybersecurity spending, investors still need to be selective.

Focus on companies that are demonstrating an ability to turn the growing need for protection into new customers, increased spending from existing customers, and stronger revenue growth.

Pay particular attention to companies that can deliver protection quickly and across many systems before customers have time to install permanent fixes.

The bottom line

PHP2Shell exposed a problem that will likely grow as AI becomes more powerful.

The world’s software contains vulnerabilities that have gone undiscovered for years. AI is making it easier to find and exploit some of them, forcing businesses to rethink how quickly they can respond.

That creates a potentially powerful tailwind for cybersecurity companies, especially those that can detect and block new attacks before businesses fix the underlying weaknesses.

For more on how AI is reshaping cybersecurity—and how to position your portfolio as this story unfolds—check out our all-in-one investing hub, Curzio Alpha.