Seven claims. Seven fact checks. No hype.

Applying PHP patchPHP2Shell made headlines about AI, millions of vulnerable websites, and an internet-wide security crisis.

Let’s separate facts from exaggeration.

1. Did AI discover a critical new vulnerability?

Misleading.

The underlying out-of-memory handling problem was already identified by a PHP core developer in 2024, while addressing findings from a security audit.

AI-assisted researchers later identified exploitable paths, additional vulnerabilities, and developed working attack chains.

Finding a programming flaw and developing an exploit are two different things.

2. Is 70% of the internet vulnerable?

False.…