PHP2Shell Flaws Show How AI Can Make Old Bugs Exploitable
Within hours of newly public flaws in the widely used PHP language, attackers made millions of exploitation attempts. Researchers say AI speeds up bug analysis, but it is not a fundamentally new process and still relies on human expertise.
Criminal hackers began trying to exploit a set of PHP programming language vulnerabilities, collectively called PHP2Shell, within hours of their publication this week. Analysis by internet infrastructure company Cloudflare points to millions of attempts. PHP runs on a great many websites, so security teams and web administrators rushed to apply patches.
The feared scenario of mass server takeovers and data breaches has not materialized so far. The PHP Foundation, which supports the language, says it has seen no successful exploitation, and many exploits circulating publicly appear not to work.
Old bugs, new tools
Researchers at security company Calif first identified the flaws and built working exploits in early August. They used frontier AI tools through OpenAI's Patch the Planet program, along with expert human knowledge of PHP. Some of the underlying problems were identified in 2024 but judged too complex to exploit at the time. Researchers at OpenAI and at Wiz, a security firm owned by Google, later found PHP2Shell flaws independently using AI tools.
Sagi Tzadik, a security researcher at Wiz, says the PHP team had known about the vulnerability for years but did not fix it because an attacker, at least a human one, could not use it.
Pressure on security teams
AI makes it faster to analyze and potentially exploit vulnerabilities, adding strain on IT teams and developers. Microsoft's security updates this month included a record 1,453 vulnerabilities, and Bank of America recently hired 1,000 consultants to fix flaws discovered by Anthropic's Mythos model.
Researchers stress that AI is magnifying existing dynamics of vulnerability discovery rather than doing something new. Jake Williams, a former NSA hacker and vice president of research and development at Hunter Strategy, expects more long-lived bugs to surface but thinks the supply of such easy targets is limited, since PHP is unusually exposed to the internet. Ryan Austin of Calif wrote that no model can find all bugs with simple prompts. Security engineer Niels Provos says he is not really worried, noting that finding this flaw required a highly skilled team.
