Security teams and web administrators rushed to patch a newly disclosed PHP vulnerability this week as criminal hackers began trying to exploit it. Cloudflare reported millions of exploitation attempts within hours of the disclosure. Although the mass compromise feared by some has not occurred, the episode highlights how artificial intelligence can turn long-known, difficult-to-exploit weaknesses into immediate security threats.
The vulnerabilities, collectively known as PHP2Shell, have attracted widespread attention because AI tools can help attackers analyze and weaponize flaws more quickly. The PHP Foundation says there have been no successful exploits of the bugs so far, even though multiple potential exploits are publicly available. Rapid7 reported that there appeared to be no effect, a view also expressed by others.
AI turns old weaknesses into new risks
The PHP2Shell vulnerability was first identified by researchers at security firm Calif, partly through the use of frontier AI tools as part of OpenAI’s Patch the Planet program. Human expertise in PHP, its underlying design and its weaknesses also played an important role. Some of the fundamental problems had been identified in 2024, but the vulnerability was considered too complex to exploit at the time.
After Calif’s discovery, researchers at OpenAI and Google’s security company Wiz independently found flaws in PHP2Shell using AI tools.
“This vulnerability has been known to PHP teams for years, but it went unaddressed because it wasn’t available to attackers, or at least not to humans,” said Sagi Tzadik, a security researcher at Wiz.
No software is perfect, and weaknesses are inevitable even in widely used foundational digital tools. However, the expanding capabilities of AI models allow researchers and attackers to analyze vulnerabilities and potentially develop exploits more quickly. That increases the pressure on resource-constrained IT teams, developers and administrators to keep up.
Microsoft’s security updates this month included records for 1,453 security vulnerabilities. Bank of America recently hired 1,000 consultants to fix flaws discovered by Anthropic’s Mythos.
Security researchers emphasize that AI is not ultimately introducing a new process. Instead, it is accelerating and expanding the existing cycle of vulnerability discovery, exploitation and coordinated disclosure.
Source: www.wired.com