Static Analysis Meets Artificial Intelligence: A Hybrid Framework for PHP Vulnerability Detection Using DeepSeek LLM and Machine Learning

The fast adoption of Large Language Models (LLMs) for code generation has revolutionised the process of constructing online applications; nevertheless, the security implications of AI-generated PHP code are still not fully understood. Combining static analysis, machine learning, and LLM-driven intelligence, this research provides a comprehensive hybrid vulnerability detection system that can identify security weaknesses in PHP web applications. The method is designed to identify vulnerabilities in PHP web applications. Utilising eleven different vulnerability categories that are connected to the CWE and OWASP Top 10 standards, our system is more secure. In addition, a trainable Random Forest classifier that utilises TF-IDF vectorisation is utilised, and DeepSeek LLM is incorporated for the purpose of providing intelligent explanations and remediation guidance. We demonstrate that the framework finds 15 vulnerabilities across 8 CWE categories from a single configuration file by conducting exhaustive assessments on vulnerable PHP code samples. As a result, the framework achieves a Security Score of 62%. A total of eight medium vulnerabilities, two critical vulnerabilities (SQL Injection), four high vulnerabilities (Hardcoded Credentials, Authentication Bypass, and Broken Access Control), and one low vulnerability were discovered by the static analysis engine. With the help of DeepSeek, the neuro-symbolic pattern generating component was able to attain an average accuracy of 76.6% while simultaneously lowering the amount of time required to produce patterns from weeks to hours. Authentication Security (0%-27% coverage) and HTTP Security Headers (0% coverage) were found to have major gaps in coverage due to the risk assessment that was conducted across five different LLM models. The fact that the whole open-source Streamlit application provides interactive vulnerability reporting along with the ability to export in both JSON and HTML demonstrates that hybrid AI-driven static analysis is an essential tool in contemporary DevSecOps workflows.

Static Analysis, PHP Security, Vulnerability Detection, Machine Learning, DeepSeek LLM

1. W3Techs, "Usage statistics and market share of PHP for websites," 2024. [Online]. Available: https://w3techs.com/technologies/details/pl-php [Google Scholar] [Crossref]

2. CVE Numbering Authorities (CNAs), "CVE Statistics," 2024. [Online]. Available: https://www.cve.org/programorganization/cnas [Google Scholar] [Crossref]

3. IBM, "What is the Log4j Vulnerability?," 2024. [Online]. Available: https://www.ibm.com/think/topics/log4j [Google Scholar] [Crossref]

4. Al-Suqri MN, Gillani M. A comparative analysis of information and artificial intelligence toward national security. Ieee Access. 2022 Jun 16;10:64420-34. [Google Scholar] [Crossref]

5. S. Phanireddy, "Securing Modern Web Applications Using AI-Driven Static and Dynamic Analysis Techniques," International Journal of Artificial Intelligence and Data Science, vol. 6, no. 2, pp. 1-10, 2025. [Google Scholar] [Crossref]

6. OpenAI, "Introducing ChatGPT," 2022. [Online]. Available: https://openai.com/blog/chatgpt [Google Scholar] [Crossref]

7. Shani I. Survey reveals AI’s impact on the developer experience| The GitHub Blog. GitHub Blog (June 2023) [Internet]. 2023 Available: https://github.blog/2023-06-13-survey-reveals-ais-impact-on-the-developer-experience [Google Scholar] [Crossref]

8. J. Savelka, A. Agarwal, C. Bogart, Y. Song, and M. Sakr, "Can Generative Pretrained Transformers (GPT) Pass Assessments in Higher Education Programming Courses?," in Proceedings of the 2023 Conference on Innovation and Technology in Computer Science Education V.1, 2023, pp. 117-123. [Google Scholar] [Crossref]

9. S. Dou et al., "What's Wrong with Your Code Generated by Large Language Models? An Extensive Study," arXiv preprint arXiv:2407.06153, 2024. [Google Scholar] [Crossref]

10. M. Dakhel et al., "GitHub Copilot AI pair programmer: Asset or Liability?," arXiv preprint arXiv:2206.15331, 2023. [Google Scholar] [Crossref]

11. R. Tóth, T. Bisztray, and L. Erdődi, "LLMs in web development: Evaluating LL-generated PHP code unveiling vulnerabilities and limitations," in International Conference on Computer Safety, Reliability, and Security, 2024, pp. 425-437. [Google Scholar] [Crossref]

12. N. Perry, M. Srivastava, D. Kumar, and D. Boneh, "Do Users Write More Insecure Code with AI Assistants?," in Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, 2023, pp. 2785-2799. [Google Scholar] [Crossref]

13. B. Chess and G. McGraw, "Static analysis for security," IEEE Security & Privacy, vol. 2, no. 6, pp. 76-79, 2004. [Google Scholar] [Crossref]

14. X. Rival and K. Yi, Introduction to static analysis: an abstract interpretation perspective. MIT Press, 2020. [Google Scholar] [Crossref]

15. B. Johnson, Y. Song, E. Murphy-Hill, and R. Bowdidge, "Why don't software developers use static analysis tools to find bugs?," in 2013 35th International Conference on Software Engineering (ICSE), 2013, pp. 672-681. [Google Scholar] [Crossref]

16. P. Emanuelsson and U. Nilsson, "A comparative study of industrial static analysis tools," Electronic Notes in Theoretical Computer Science, vol. 217, pp. 5-21, 2008. [Google Scholar] [Crossref]

17. Russo and A. Sabelfeld, "Dynamic vs. static flow-sensitive security analysis," in 2010 23rd IEEE Computer Security Foundations Symposium, 2010, pp. 186-199. [Google Scholar] [Crossref]

18. Z. Sheng et al., "LLMs in Software Security: A Survey of Vulnerability Detection Techniques and Insights," ACM Computing Surveys, vol. 58, no. 5, Article 134, 2025. [Google Scholar] [Crossref]

19. Z. Li et al., "Vuldeepecker: A deep learning-based system for vulnerability detection," arXiv preprint arXiv:1801.01681, 2018. [Google Scholar] [Crossref]

20. Z. Li et al., "Sysevr: A framework for using deep learning to detect software vulnerabilities," IEEE Transactions on Dependable and Secure Computing, vol. 19, no. 4, pp. 2244-2258, 2021. [Google Scholar] [Crossref]

21. DeepSeek, "DeepSeek API Platform," 2024. [Online]. Available: https://platform.deepseek.com/ [Google Scholar] [Crossref]

22. DeepSeek-AI, "DeepSeek-V3: Technical Report," arXiv preprint arXiv:2412.19437, 2024. [Google Scholar] [Crossref]

23. S. Phanireddy, "API Security: Offensive and Defensive Strategies," International Journal of Innovative Research and Creative Technology, vol. 10, no. 4, pp. 1-6, 2024. [Google Scholar] [Crossref]

24. Li Z, Zou D, Xu S, Jin H, Zhu Y, Zhang Y, Chen Z, Li D. Vuldeelocator: A deep learning-based system for detecting and locating software vulnerabilities. IEEE Transactions on Dependable and Secure Computing. 2021 Jan. [Google Scholar] [Crossref]

25. Li Z, Zou D, Xu S, Jin H, Zhu Y, Chen Z. Sysevr: A framework for using deep learning to detect software vulnerabilities. IEEE Transactions on Dependable and Secure Computing. 2021 Jan 13;19(4):2244-58. [Google Scholar] [Crossref]

26. Y. Zhou et al., "Devign: Effective Vulnerability Identification by Learning Comprehensive Program Semantics via Graph Neural Networks," in Advances in Neural Information Processing Systems, 2019. [Google Scholar] [Crossref]

27. Li Z, Zou D, Xu S, Chen Z, Zhu Y, Jin H. Vuldeelocator: a deep learning-based fine-grained vulnerability detector. IEEE Transactions on Dependable and Secure Computing. 2021 Apr 27;19(4):2821-37. [Google Scholar] [Crossref]

28. X. Wang et al., "AutoVulnPHP: A Framework for Automated PHP Vulnerability Detection," arXiv preprint, 2024. https://arxiv.org/abs/2601.06177 [Google Scholar] [Crossref]

29. Li P, Yao S, Sarfati Korich J, Luo C, Yu J, Cao Y, Yang J. Automated static vulnerability detection via a holistic neuro-symbolic approach. arXiv e-prints. 2025 Apr:arXiv-2504. [Google Scholar] [Crossref]

30. S. Elder, N. Zahan, V. Kozarev, R. Shu, T. Menzies, and L. Williams, "Structuring a Comprehensive Software Security Course Around the OWASP Application Security Verification Standard," in 2021 IEEE/ACM 43rd International Conference on Software Engineering: Software Engineering Education and Training (ICSE-SEET), 2021, pp. 95-104. [Google Scholar] [Crossref]

31. T. Xiaotian, Z. Xiaosong and C. Ruidong, "Collaborative Agent Framework for Web Vulnerability Discovery in Source Code," 2025 22nd International Computer Conference on Wavelet Active Media Technology and Information Processing (ICCWAMTIP), Chengdu, China, 2025, pp. 1-12, doi: 10.1109/ICCWAMTIP68645.2025.11352622. [Google Scholar] [Crossref]

32. X. Liu et al., "DeepSeek-V3: A 671B Parameter Model with Multi-head Latent Attention," arXiv preprint, 2024. Available: https://arxiv.org/abs/2412.19437 [Google Scholar] [Crossref]

33. CWE, "Common Weakness Enumeration," 2024. [Online]. Available: https://cwe.mitre.org/ [Google Scholar] [Crossref]

34. Y. Zhou, E. Wang, and S. Ma, "SSRFSeek: An LLM-based Static Analysis Framework for Detecting SSRF Vulnerabilities in PHP Applications," in 2025 IEEE 6th International Seminar on Artificial Intelligence, Networking and Information Technology (AINIT), Chengdu, China, 2025. available: https://ieeexplore.ieee.org/document/11035424 [Google Scholar] [Crossref]

35. OWASP, "OWASP Juice Shop," 2024. [Online]. Available: https://owasp.org/www-project-juice-shop/ [Google Scholar] [Crossref]

36. OWASP, "WebGoat," 2024. [Online]. Available: https://owasp.org/www-project-webgoat/ [Google Scholar] [Crossref]

37. Author's Implementation, "Ultimate PHP Vulnerability Detector," 2026. [Online]. Available: https://github.com/cycyberuk/php-vuln-detector (Accessed: July 2026). [Google Scholar] [Crossref]

• Enhancing Formation Control of Multi Agent Systems Using Ann Based Technique
• Improving Sliding Mode Control with Chattering Reduction using Fuzzy Based Technique
• Cooking Quality, Fasting Blood Glucose, Glycemic Index and Load of High–Fiber Noodles Made from Wheat, Tiger Nut Residue and Cassava Flour Blends
• Matrix Rhythm Therapy Versus Interferential Therapy Combined with Lumbar Stabilization Exercises in Chronic Non-Specific Low Back Pain: A Randomized Comparative Trial
• Formulation and Sensory Evaluation of Functional Cake Prepared from Sweet Potato Powder