The fast adoption of Large Language Models (LLMs) for code generation has revolutionised the process of

constructing online applications; nevertheless, the security implications of AI-generated PHP code are still not

fully understood. Combining static analysis, machine learning, and LLM-driven intelligence, this research

provides a comprehensive hybrid vulnerability detection system that can identify security weaknesses in PHP

web applications. The method is designed to identify vulnerabilities in PHP web applications. Utilising eleven

different vulnerability categories that are connected to the CWE and OWASP Top 10 standards, our system is

more secure. In addition, a trainable Random Forest classifier that utilises TF-IDF vectorisation is utilised, and

pattern generating component was able to attain an average accuracy of 76.6% while simultaneously lowering

the amount of time required to produce patterns from weeks to hours. Authentication Security (0%-27%

coverage) and HTTP Security Headers (0% coverage) were found to have major gaps in coverage due to the risk

assessment that was conducted across five different LLM models. The fact that the whole open-source Streamlit

application provides interactive vulnerability reporting along with the ability to export in both JSON and HTML

demonstrates that hybrid AI-driven static analysis is an essential tool in contemporary DevSecOps workflows.

Keywords: Static Analysis, PHP Security, Vulnerability Detection, Machine Learning, DeepSeek LLM

Web applications have emerged as the foundation of contemporary digital infrastructure, facilitating a range of

cyber threats due to architectural deficiencies. Conventional security analysis techniques, such as manual code

inspections and rule-based vulnerability scanners, are progressively unable to tackle the expanding threat

landscape of today. The intricacy of contemporary web applications, defined by convoluted code frameworks,

multi-tiered services, and substantial third-party interconnections, renders manual diagnosis difficult [5].

Large Language Models have radically altered the software development landscape. ChatGPT achieved 100

million users in just two months after introduction, a growth rate that outstrips core technologies such as the

Internet itself [6]. Software engineers are increasingly using models such as ChatGPT, GitHub Copilot, Claude,

Gemini and DeepSeek to complete, generate and translate code. Recent polls show that generative models assist

These efficiency improvements are great, but integrating LLMs into development workflows introduces some

serious security concerns. Different from compilers or static analysers [9], LLMs produce code probabilistically,

and do not do semantic verification and secure design principle enforcement. Therefore, they tend to generate

solutions that look functionally correct on the surface but are fundamentally fragile in their architecture [10].

There is empirical evidence behind these issues. Tóth et al. [11] demonstrated that 27% of the programs produced

by GPT-4 have proven vulnerabilities in PHP code. A research of 2500 PHP websites found 2,440 susceptible

parameters and 26% of the sites had at least one exploitable vulnerability [11]. Perry et al. [12] observed that

code written by developers using AI assistants has more security flaws and the developers are more confident in

the security of their code, a concerning combination that increases the likelihood of vulnerabilities making it into

production systems.

overwhelm engineers [15] and typically fail in modern development paradigms like asynchronous JavaScript

and dependency injection [16]. At contrast, dynamic analysis tests applications at runtime to identify

vulnerabilities that can be revealed only during execution [17]. Dynamic analysis is useful for context-dependent

vulnerabilities but does not find problems in code pathways that are not exercised during testing. The fusion of

static analysis with artificial intelligence gives a feasible development direction [18]. Static analysis with AI

uses machine learning classifiers, natural language processing for code understanding, and deep learning models

to find vulnerabilities that rule-based approaches cannot detect [19]. AI models can find subtle security trends,

adapt to new programming frameworks and drastically cut down on false positive rates by analyzing vast datasets

of annotated code [20].

Recent advances in affordable LLMs such as DeepSeek [21] have made it possible to use advanced AI for

analysis (11 CWE categories), machine learning (Random Forest with TF-IDF), and DeepSeek LLM

integration for smart vulnerability discovery and mitigation.

2. Neuro-Symbolic Pattern Generation: To automatically produce vulnerability detection patterns, we

propose a DeepSeek LLM based method for pattern building that reduces the time from weeks to hours

and achieves expert-level performance (76.6% average accuracy).

3. Comprehensive Risk Assessment: We undertake risk assessment across five LLM models (Grok, GPT,

Gemini, Claude, DeepSeek) and six security areas and find significant holes in HTTP Security Headers

(0% coverage) and Authentication Security (0-27% coverage).

4. Practical Vulnerability Detection: We show the efficiency of the framework by analyzing a vulnerable

PHP configuration file. It detects 15 vulnerabilities in 8 CWE categories with a Security Score of 62%.

presents the experimental setup, dataset, and evaluation measures. Section 5 we examine and show our results

including practical vulnerability detection, performance comparisons, risk assessment and case studies. Section

6 presents constraints and challenges to validity. Section 7 finishes the work by discussing directions for future

research.

Traditional vulnerability detection methodologies can be generally divided into static analysis, dynamic analysis

and hybrid approaches. Static analysis is a method of analyzing source code without executing it. It uses rule-

based pattern matching to search for vulnerabilities [13]. Tools such as SonarQube, Fortify, and Checkmarx are

frequently used in industry but suffer from high false positive rates which can overwhelm developers [15].

classifiers like Random Forest [24] and Support Vector Machines [25] on hand-crafted features derived from

source code. Convolutional Neural Networks [26] and Long Short-Term Memory networks [27] based deep

learning methods have shown excellent performance in capturing complex code patterns. Wang et al. [28]

proposed AutoVulnPHP, a complete system that combines two-stage vulnerability detection and accurate

automated localization. The framework can reach 99.7% detection accuracy and 99.5% F1-score on the public

benchmarks. AutoVulnPHP was able to find 429 undiscovered vulnerabilities in real-world repositories with

351 of the vulnerabilities being awarded CVE IDs. The authors also constructed PHPVD, the first large-scale

PHP vulnerability dataset, which contains 26,614 files and covers seven different vulnerability classes [28].

The combination of static analysis with LLMs has become a promising research path. Li et al. [29] proposed

found 46 new vulnerability patterns that were missed by security specialists and uncovered 25 previously

unknown vulnerabilities in real-world apps.

analysis with LLMs. STaint uses semantic reasoning to detect second-order vulnerabilities in PHP applications.

We initially evaluate ten real-life PHP apps. The results show that we successfully identify 56 second-order

vulnerability paths and find 7 new ones, surpassing the existing approaches.

VoidSight [31] is a multi-agent collaborative framework for web vulnerability identification, which is built on

three interconnected phases with Retrieval-Augmented Generation, code embeddings and multi-agent dialogue

system. This methodology transforms vulnerability identification from similarity matching with static code

representations into an interactive reasoning process with active information collection. Currently VoidSight has

found 12 vulnerabilities in 8 projects, receiving 12 CVE ids.

DeepSeek [21] has become a powerful open-source alternative to commercial LLMs, with competitive

makes them acceptable for the hybrid detection methodology proposed in this research [34]. DeepSeek is also

affordable and offers new users 5 million free tokens, making this strategy feasible for academic research.

Figure 1: Architecture of the hybrid vulnerability detection framework

For validation and real-world testing, we utilized:

ML module to learn semantic patterns beyond the syntactic matching, the DeepSeek integration for contextual

understanding of code, and the neuro-symbolic pattern generation approach for generating more sophisticated

detection rules [29]. In the future, we will add more advanced static analysis tools such as PHPStan, Psalm, and

SonarQube to increase the detection of dataflow-dependent vulnerabilities.

The machine learning module employs a Random Forest classifier with TF-IDF vectorization for vulnerability

detection.

Code samples are transformed into feature vectors using:

 TF-IDF Vectorization: max_features=1000, ngram_range=(1,3), stop_words='english'

 class_weight: 'balanced' (handles class imbalance)

 Cross-Validation: 5-fold stratified K-Fold

 Performance Metrics: Accuracy, Precision, Recall, F1-Score

Trained models can be saved and loaded using Pickle serialization, enabling:

 Model versioning and sharing

 Deployment without retraining

 Continuous improvement with new data

We leverage DeepSeek LLM for intelligent vulnerability explanations and pattern generation. DeepSeek's cost-

effectiveness (5 million free tokens for new users) makes it ideal for academic research [21].

iteratively refine based on false positive and false negative analysis

Figure 2: Neuro-symbolic pattern generation process with DeepSeek

Source: [37].

the framework is modular allowing alternative LLMs (GPT, Claude, Gemini), generated patterns can be stored

and reused without re-issuing API calls, local deployment options (Ollama, local DeepSeek instances) are being

explored, and a pattern caching mechanism will be added.

Risk Levels:

 Critical: Immediate threat to system security

 Very High: High probability of exploitation

 High: Significant security risk

 Medium: Moderate security risk

 Low: Minimal security risk

 Very Low: Negligible security risk

The overall security score is calculated using a weighted scoring system:

// Security Score = 100 - (Total Weighted Risk / Max Possible Weight)

the most vulnerable.

We employed standard metrics for model evaluation:

- Accuracy: Overall correctness of predictions

- Precision: True positives / (True positives + False positives)

- Recall: True positives / (True positives + False negatives)

- F1-Score: 2 × (Precision × Recall) / (Precision + Recall)

- False Positive Rate (FPR): False positives / (False positives + True negatives)

- False Negative Rate (FNR): False negatives / (False negatives + True positives)

Software Environment:

Key Findings from Coverage Analysis:

2. Input Validation & Injection: Claude achieves the highest coverage (80%), while DeepSeek and Gemini

show the lowest (30%).

3. Session Security: ChatGPT and Gemini achieve 100% coverage; Claude and DeepSeek show

2. Vulnerability Coverage: Though the 11 CWE categories comply with OWASP Top 10 standards, they

do not include all possible vulnerability kinds. Some classes of vulnerabilities (e.g. business logic

problems, race situations) are not covered by our present set of patterns.

3. Language Focus: The study was limited to PHP which runs over 75% of the websites worldwide [1], but

limits generalisability to other programming languages. Future work will expand the framework to

Python, Java and JavaScript for increased utility in polyglot programming environments.

1. Static analysis coverage: Pattern matching based on regular expressions cannot find all types of

vulnerabilities, particularly those that need more complex data flow or inter-procedural analysis [15, 16].

The hybrid technique with ML and LLM integration somewhat mitigates this but the static engine is still

studied.

1. Internal Validity: The link between the usage of LLMs and the number of vulnerabilities does not imply

causality. Our risk assessment shows correlations, but causative linkages would have to be determined

by controlled studies.

2. External Validity: Results may not be generalized to other LLM models or development environments.

We evaluate five LLM models (Grok, GPT, Gemini, Claude, DeepSeek) on five datasets, which partially

addresses issue, although the landscape of LLMs moves rapidly.

3. Construct Validity: The vulnerability categories and detection rules might not cover all important security

flaws. Our categories were derived from CWE and OWASP standards [2, 33] to achieve maximum

1. Effective Vulnerability Detection: 15 vulnerabilities detected across 8 CWE categories from a single

configuration file.

2. Security Score Assessment: A Security Score of 62% provides a quantitative benchmark for security

posture.

3. Risk Distribution: 2 Critical, 4 High, 8 Medium, and 1 Low severity vulnerabilities identified.

4. Superior Performance: The hybrid approach achieved an F1-score of 90%, outperforming static-only

(81%) and dynamic-only (84%) methods.

5. Efficient Pattern Generation: Neuro-symbolic pattern generation with DeepSeek achieved 76.6% average

accuracy while reducing development time from weeks to hours.

6. Critical LLM Gaps: Risk assessment revealed HTTP Security Headers (0% coverage) and Authentication

Security (0-27% coverage) as critical gaps across all LLM models.

For Practitioners:

1. Integrate static analysis in CI/CD pipelines for early vulnerability detection

3. Maintain human security review despite AI capabilities

4. Implement essential HTTP Security Headers manually (CSP, X-Frame-Options, HSTS)

For Educators:

1. Integrate security literacy into programming curricula

2. Use TaSM-based frameworks for security education

3. Teach critical evaluation of AI-generated code

3. Investigate automated HTTP security header implementation

4. Expand Security Score framework to include additional metrics

1. Multi-Tool Integration: Use PHPStan, Psalm, and SonarQube to achieve dataflow and inter-procedural

analysis beyond regex-based matching, increasing detection depth.

2. To improve utility in modern, polyglot development environments, add Python, Java, and JavaScript

support to the framework.

3. DeepSeek can be fine-tuned on secure coding datasets (PHPVD [28], SARD test cases) to improve code

quality and reduce vulnerabilities.

4. Automated Remediation: Move beyond guidance to automated security hardening by generating secure

awareness affects code quality and how to better integrate security education into AI workflows.

8. Expand the Security Score framework to include OWASP ASVS coverage, vulnerability density, and

remediation effort estimation.

The study shows that LLMs provide large productivity gains but are also associated with severe security risks

when utilized with little security awareness. The combination technique of static analysis, machine learning and

DeepSeek LLM is a promising solution that provides enhanced detection accuracy, less false positives and

efficient pattern formation. The practical demonstration of 15 vulnerability detections from a single PHP

configuration file demonstrates the effectiveness of the framework in discovering real-world security

vulnerabilities. The Security Score of 62% provides a clear quantitative measure of the security improvement,

and the detailed remediation guidance facilitates developers to systematically fix the identified vulnerabilities.

Importantly, the risk assessment revealed that all LLM models assessed lack critical HTTP Security Headers

(0% coverage) and have considerable deficiencies in Authentication Security (0-27% coverage). This underlines

the core argument that AI is an unreliable primary security control and cannot substitute for human security

The open-source Streamlit implementation offers developers a useful and easy to access way to test and enhance

the security of their PHP web applications. This work contributes to the larger goal of improving web application

tested solely in a local isolated environment, utilizing VS Code, Python 3.9, Streamlit, WAMP Server 3.4 with

PHP 8.3 on Windows 10 Pro (Intel Core i7, 12GB RAM) and no network exposure during the development. We

do not collect or process any data from third parties unless you opt in to DeepSeek LLM API calls with no

persistent storage. Research was conducted according to the ethical principles. All software used is open source

and licensed under permissive licenses (MIT, BSD, Apache).

https://www.ibm.com/think/topics/log4j

4. Al-Suqri MN, Gillani M. A comparative analysis of information and artificial intelligence toward

national security. Ieee Access. 2022 Jun 16;10:64420-34.

5. S. Phanireddy, "Securing Modern Web Applications Using AI-Driven Static and Dynamic Analysis

Techniques," International Journal of Artificial Intelligence and Data Science, vol. 6, no. 2, pp. 1-10,

2025.

6. OpenAI, "Introducing ChatGPT," 2022. [Online]. Available: https://openai.com/blog/chatgpt

7. Shani I. Survey reveals AI’s impact on the developer experience| The GitHub Blog. GitHub Blog (June

2023) [Internet]. 2023 Available: https://github.blog/2023-06-13-survey-reveals-ais-impact-on-the-

developer-experience

arXiv:2206.15331, 2023.

11. R. Tóth, T. Bisztray, and L. Erdődi, "LLMs in web development: Evaluating LL-generated PHP code

unveiling vulnerabilities and limitations," in International Conference on Computer Safety, Reliability,

and Security, 2024, pp. 425-437.

12. N. Perry, M. Srivastava, D. Kumar, and D. Boneh, "Do Users Write More Insecure Code with AI

Assistants?," in Proceedings of the 2023 ACM SIGSAC Conference on Computer and

Communications Security, 2023, pp. 2785-2799.

13. B. Chess and G. McGraw, "Static analysis for security," IEEE Security & Privacy, vol. 2, no. 6, pp. 76-

79, 2004.

14. X. Rival and K. Yi, Introduction to static analysis: an abstract interpretation perspective. MIT Press,

2020.

15. B. Johnson, Y. Song, E. Murphy-Hill, and R. Bowdidge, "Why don't software developers use static

analysis tools to find bugs?," in 2013 35th International Conference on Software Engineering (ICSE),

2013, pp. 672-681.

16. P. Emanuelsson and U. Nilsson, "A comparative study of industrial static analysis tools," Electronic

Notes in Theoretical Computer Science, vol. 217, pp. 5-21, 2008.

17. Russo and A. Sabelfeld, "Dynamic vs. static flow-sensitive security analysis," in 2010 23rd IEEE

Insights," ACM Computing Surveys, vol. 58, no. 5, Article 134, 2025.

23. S. Phanireddy, "API Security: Offensive and Defensive Strategies," International Journal of Innovative

Research and Creative Technology, vol. 10, no. 4, pp. 1-6, 2024.

24. Li Z, Zou D, Xu S, Jin H, Zhu Y, Zhang Y, Chen Z, Li D. Vuldeelocator: A deep learning-based system

for detecting and locating software vulnerabilities. IEEE Transactions on Dependable and Secure

Computing. 2021 Jan.

25. Li Z, Zou D, Xu S, Jin H, Zhu Y, Chen Z. Sysevr: A framework for using deep learning to detect

software vulnerabilities. IEEE Transactions on Dependable and Secure Computing. 2021 Jan

13;19(4):2244-58.

26. Y. Zhou et al., "Devign: Effective Vulnerability Identification by Learning Comprehensive Program

Semantics via Graph Neural Networks," in Advances in Neural Information Processing Systems, 2019.

a holistic neuro-symbolic approach. arXiv e-prints. 2025 Apr:arXiv-2504.

30. S. Elder, N. Zahan, V. Kozarev, R. Shu, T. Menzies, and L. Williams, "Structuring a Comprehensive

Software Security Course Around the OWASP Application Security Verification Standard," in 2021

IEEE/ACM 43rd International Conference on Software Engineering: Software Engineering Education

and Training (ICSE-SEET), 2021, pp. 95-104.

31. T. Xiaotian, Z. Xiaosong and C. Ruidong, "Collaborative Agent Framework for Web Vulnerability

Discovery in Source Code," 2025 22nd International Computer Conference on Wavelet Active Media

Technology and Information Processing (ICCWAMTIP), Chengdu, China, 2025, pp. 1-12, doi:

10.1109/ICCWAMTIP68645.2025.11352622.

32. X. Liu et al., "DeepSeek-V3: A 671B Parameter Model with Multi-head Latent Attention," arXiv

35. OWASP, "OWASP Juice Shop," 2024. [Online]. Available: https://owasp.org/www-project-juice-

shop/

36. OWASP, "WebGoat," 2024. [Online]. Available: https://owasp.org/www-project-webgoat/

37. Author's Implementation, "Ultimate PHP Vulnerability Detector," 2026. [Online]. Available:

https://github.com/cycyberuk/php-vuln-detector (Accessed: July 2026).