Security teams and web administrators are rushing to patch newly public PHP vulnerabilities after criminal hackers launched millions of exploitation attempts within hours of the flaws being disclosed. The scale of the immediate response highlights how artificial intelligence tools are lowering the barrier for attackers to weaponize software defects.
Analysis from Cloudflare indicates that the volume of attacks was immediate and massive. Despite the surge in activity, the PHP Foundation states it has not observed any successful exploitation of the bugs. Many of the exploit scripts circulating online have proven ineffective against live systems.
AI Uncovers Historic PHP2Shell Flaws
The vulnerabilities, collectively known as PHP2Shell, represent a shift in how security researchers identify and exploit code defects. While the underlying issues were identified in 2024, they were initially deemed too complex for human attackers to leverage. AI models have since helped turn these dormant flaws into active threats.
Researchers at the security firm Calif were the first to identify the PHP2Shell vulnerabilities and create working exploits in early August. They utilized frontier AI tools as part of OpenAI’s Patch the Planet program, combining automated analysis with expert human knowledge of PHP architecture. Following this discovery, researchers at OpenAI and Wiz, a security firm owned by Google, independently found similar flaws using AI assistance.
Sagi Tzadik, a security researcher at Wiz, explained the dynamic to Wired. “The vulnerability had been known to the PHP team for years, but because it could not be leveraged by an attacker, at least, not a human one, it was not addressed,” Tzadik said.
Pressure on Under-Resourced Teams
The rapid discovery and exploitation of these bugs place significant pressure on under-resourced IT teams, developers, and administrators. The volume of vulnerabilities is growing across the industry. Microsoft recently issued security updates for a record 1,453 vulnerabilities in a single month. Similarly, Bank of America hired 1,000 consultants to address flaws discovered by Anthropic’s Mythos AI model.
Security experts emphasize that AI is not creating new types of vulnerabilities, but rather magnifying existing dynamics of vulnerability discovery and coordinated disclosure. The technology accelerates the timeline between finding a bug and seeing it exploited in the wild.
Despite the alarming headlines, some experts suggest the situation is manageable. Jake Williams, vice president of research and development at Hunter Strategy and a former NSA hacker, noted that while more long-life bugs will likely emerge, there is a limit to this low-hanging fruit. “It’s a pretty wild attack surface, most other tools aren’t exposed to the internet by design,” Williams said regarding PHP.
Researchers also point out that sophisticated AI-aided hacking still requires human expertise. Ryan Austin, the Calif researcher who first discovered the PHP flaws, wrote that no model is simply capable of unearthing all bugs with simple prompts. Niels Provos, a security engineer and researcher, advised against excessive alarm. “To be honest, I am not really worried,” Provos said. “People have now been looking with AI for over a year, and it required a highly skilled team to find this one. I guess we will see whether I am completely wrong, but I doubt it.”
Source: Wired
