PHP2Shell Flaws Draw Millions of Exploit Attempts Within Hours
Millions of attempts to exploit newly disclosed PHP flaws arrived within hours, Cloudflare analysis found. The PHP Foundation says it has seen no successful…
Millions of exploit attempts hit within hours of newly public PHP vulnerabilities, according to Cloudflare analysis. The PHP meltdown shows makes AI’s role in security more complicated: tools can help attackers move quickly, but they also helped researchers turn long-known flaws into practical exploits.
The PHP Foundation says it has not seen a successful exploitation of the vulnerabilities, collectively called PHP2Shell. Many potential exploits circulating publicly also appear ineffective, according to WIRED’s reporting. The immediate danger has not become the mass takeover scenario some feared, but security teams and web administrators have been scrambling to apply patches.
AI helped make old PHP flaws practical
Researchers at security company Calif first identified the PHP2Shell vulnerabilities and created exploits in early August, partly using frontier AI tools through OpenAI’s Patch the Planet program. Their work also relied on expert human knowledge of PHP, its behavior and its weaknesses.
Some underlying issues had been identified in 2024, but researchers considered them too complex to exploit at the time. After Calif’s discovery, researchers at OpenAI and Google-owned security firm Wiz independently found PHP2Shell flaws using AI tools.
“The vulnerability had been known to the PHP team for years, but because it could not be leveraged by an attacker—at least, not a human one—it was not addressed,” said Sagi Tzadik, a security researcher at Wiz.
That shift matters because a vulnerability can remain in software without being practically exploitable, then become a more immediate risk as analysis improves. WIRED reported that AI tools can speed up vulnerability analysis and potentially help attackers exploit flaws, increasing pressure on IT teams, developers and administrators who already have limited resources.
Human expertise remains part of the process
The episode does not show AI independently finding every weakness or carrying out sophisticated attacks on its own. Researchers cited by WIRED said advanced AI-aided hacking still typically involves human expertise. Ryan Austin, the Calif researcher who first discovered the PHP flaws, wrote: “No model is simply capable of unearthing ‘all bugs’ with simple prompts. At least for now.”
Jake Williams, vice president of research and development at Hunter Strategy and a former NSA hacker, said more long-lived software bugs could become exploitable. But he also cautioned that PHP’s reach makes this case unusual. “There isn’t much else that has the specific reach of PHP,” Williams said.
The wider workload is already substantial. Microsoft’s security updates included a record 1,453 security vulnerabilities this month alone, according to WIRED. Bank of America recently hired 1,000 consultants to address flaws discovered by Anthropic’s Mythos.
Security researchers told WIRED that AI is amplifying existing patterns in vulnerability discovery and coordinated disclosure, rather than creating an entirely new kind of risk. Niels Provos, a security engineer and researcher, said he was not especially worried about an overwhelming wave of newly exploitable historic bugs, noting that it took a highly skilled team to find PHP2Shell.
For administrators, the immediate concern remains practical: patching newly disclosed PHP flaws while exploit attempts are already appearing. Cloudflare’s analysis counted millions of attempts within hours of publication.
Source: wired.com
