AI Turns Old PHP Flaws Into Urgent Threat — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Calif researchers discovered and created exploits for the PHP2Shell vulnerabilities in early August using frontier AI tools and deep PHP expertise, revealing flaws that had existed for years.
- OpenAI and Wiz researchers independently identified PHP2Shell flaws using AI, with Wiz noting the vulnerability was previously deemed unexploitable by humans despite being known to the PHP team.
- The PHP Foundation coordinated fixes for the critical PHP flaws but operates with minimal resources—just one full-time staff and 14 contractors—highlighting structural challenges in maintaining core internet infrastructure.
- Cloudflare analysts observed millions of exploitation attempts within hours of the vulnerabilities going public, underscoring how AI accelerates attackers’ ability to act on newly disclosed flaws.
- Ryan Austin of Calif emphasized that no AI model can currently unearth all bugs through simple prompts, stressing that human expertise remains essential in AI-aided vulnerability discovery.
- Niels Provos, a security engineer and researcher, downplayed fears of AI unleashing a flood of newly exploitable historic bugs, noting that over a year of AI-assisted searching has yielded few major finds beyond this case.
Why it matters: The PHP2Shell episode shows AI is not creating new attack methods but dramatically speeding up the cycle of discovery and exploitation—putting pressure on underfunded open-source projects like the PHP Foundation while raising the stakes for rapid patching. The fact that only a highly skilled team found this flaw suggests widespread AI-driven bug hunting won’t overwhelm systems overnight, but the risk window after disclosure is now dangerously short.
Ask SkimNews
