Editorial illustration for AI Makes Historic PHP Bugs More Exploitable, Turning Them Into Current Crisis
AI Exploits PHP Bugs in Mass Attack Wave
AI Makes Historic PHP Bugs More Exploitable, Turning Them Into Current Crisis
Cloudflare counted millions of exploitation attempts within hours of PHP2Shell going public this week, as criminal hackers raced to weaponize a fresh batch of bugs in one of the internet's most widely used scripting languages. The PHP Foundation says no successful breaches have been confirmed yet, and a lot of the exploit code floating around forums and GitHub repos doesn't actually work. That's the good news, for now.
The stranger part of this story isn't the attackers. It's who found the bugs in the first place, and how. Researchers at security company Calif didn't stumble onto some brand-new flaw buried deep in a recent PHP update.
They dug up practical exploits for weaknesses that had been sitting in the language, partially documented and mostly ignored, for years. They did it with help from frontier AI models, working inside OpenAI's Patch the Planet program alongside old-fashioned human expertise in PHP internals.
That combination, machine pattern-matching plus people who actually understand how PHP breaks, raises an uncomfortable question for anyone running legacy web infrastructure: how many other decades-old vulnerabilities are waiting for the same treatment.
The PHP Foundation says it hasn’t seen any successful exploitation of the bugs, collectively dubbed PHP2Shell, and many publicly circulating potential exploits appear to be ineffective. However, perhaps the most interesting role of AI amid the chaos this week is how advanced models helped researchers uncover practical exploitations for the vulnerabilities, which were known about, at least in part, for years.
Why this matters
For anyone building or shipping software with AI assistance, the PHP2Shell episode is a warning shot. Calif's researchers didn't invent a new class of bug, they used AI to resurface old ones and weaponize them faster than defenders could patch. Cloudflare logged millions of exploitation attempts within hours of disclosure.
That timeline is the story: AI compresses the gap between "vulnerability exists" and "vulnerability is exploited at scale," and that gap is exactly what security teams rely on to respond. If decades-old PHP flaws can get this kind of treatment, every legacy codebase your company still runs, the stuff nobody's touched since 2015, is suddenly back in play. For founders and developers leaning on AI tools to audit or patch code, the lesson cuts both ways: the same capability that finds these bugs for attackers can find them for you first, but only if you're actually looking.
Waiting for public disclosure is no longer a viable patch strategy. The question worth asking isn't whether more of these "historic to current crisis" conversions are coming. It's whether your team can move as fast as the tooling now allows.
Related Reading
Policy & Regulation Akamai Proposes SAFE Cybersecurity Guidelines for AI Threats
Policy & Regulation After ditching AI fitness apps and a Fitbit, I return to Peloton classes
Policy & Regulation Sony Music, Warner Chappell Sue Anthropic Over "Blatant Theft
From Archives Three-week OpenAI audit finds major gaps in AI safety monitoring
From Archives U.S. Banks Catch AI Agents Going Off-Script; Claude Opus 5.5 Powers Duet
Common Questions Answered
What is PHP2Shell and how did AI contribute to discovering exploitable vulnerabilities?
PHP2Shell refers to a collection of bugs in PHP that were previously known but had not been effectively weaponized until AI models helped researchers discover practical exploitation methods. Advanced AI models accelerated the process of turning these dormant vulnerabilities into active threats, compressing the timeline between vulnerability discovery and large-scale exploitation attempts.
How many exploitation attempts did Cloudflare record after PHP2Shell went public?
Cloudflare counted millions of exploitation attempts within hours of PHP2Shell going public this week. This rapid surge in attacks demonstrates how quickly attackers can mobilize once vulnerabilities are disclosed and exploit code becomes available.
Has the PHP Foundation confirmed any successful breaches from the PHP2Shell vulnerabilities?
The PHP Foundation has stated that no successful breaches have been confirmed yet from the PHP2Shell vulnerabilities. Additionally, many of the exploit codes circulating on forums and GitHub repositories do not actually work, which has provided some temporary protection against widespread compromise.
Why is the PHP2Shell episode considered a warning for software developers using AI?
The PHP2Shell episode demonstrates that AI can rapidly resurface old, known vulnerabilities and weaponize them faster than defenders can patch them, compressing the critical gap between vulnerability existence and large-scale exploitation. This compression of the security timeline poses a significant risk for anyone building or shipping software with AI assistance, requiring faster response and patching strategies.
Further Reading
- Papers with Code - Latest NLP Research - Papers with Code
- Hugging Face Daily Papers - Hugging Face
- ArXiv CS.CL (Computation and Language) - ArXiv
