Security teams and web administrators spent this week racing to patch newly disclosed PHP vulnerabilities as criminal hackers moved quickly to try to exploit them in the wild. Cloudflare's analysis recorded millions of exploitation attempts within hours of the flaws becoming public. That volume is not surprising, given how widely accessible AI tools are and how much they can help attackers exploit flaws quickly.
The feared outcome of mass site takeovers and breaches has not materialized so far. The PHP Foundation said it has not seen any successful exploitation of the bugs, which are collectively called PHP2Shell, and many potential exploits circulating publicly appear to be ineffective. The more notable role of AI this week may be on the research side: advanced models helped researchers work out practical exploits for vulnerabilities that had been known about, at least in part, for years, turning a historic vulnerability into a current crisis.
Researchers at the security company Calif were the first to identify the PHP2Shell vulnerabilities and build exploits in early August. They worked partly with frontier AI tools as part of OpenAI's Patch the Planet program and partly with expert human knowledge of PHP and its weaknesses, according to the report. Some of the underlying issues were identified in 2024 but were considered too complex to exploit at the time. After Calif's discovery, researchers at OpenAI and the Google-owned security firm Wiz independently found PHP2Shell flaws using AI tools. Sagi Tzadik, a security researcher at Wiz, said the PHP team had known about the vulnerability for years but did not address it because an attacker, at least a human one, could not leverage it.
No software is perfect, and even the most critical, foundational digital tools inevitably contain flaws. Expanding AI capabilities have made it faster to analyze vulnerabilities and potentially exploit them, which puts more pressure on under-resourced IT teams, developers and admins to keep up. Microsoft's security updates included a record 1,453 vulnerabilities this month alone, and Bank of America recently hired 1,000 consultants to fix flaws discovered by Anthropic's Mythos. Security researchers stress that AI is not doing anything fundamentally new; it is magnifying existing dynamics of vulnerability discovery and coordinated disclosure.
Jake Williams, vice president of research and development at Hunter Strategy and a former NSA hacker, said more of these long-life bugs that sit in every version of software for a decade or more will definitely appear. He also said there is only so much of this low-hanging fruit, because little else has PHP's reach. Williams described PHP as a wild attack surface, noting that most other tools are not exposed to the internet by design.
Researchers add that even with frontier models, most sophisticated AI-aided hacking involves human expertise. Ryan Austin, the Calif researcher who first discovered the PHP flaws, wrote this week that no model can simply unearth all bugs with simple prompts, at least for now. Security engineer and researcher Niels Provos said he is not really worried about AI finding an overwhelming number of historic bugs that are newly exploitable, or new vulnerabilities that could not have been practically exploited without AI. He noted that people have been looking with AI for over a year and that finding this one required a highly skilled team.
More AI news from TechManNews.
