The PHP2Shell Crisis: How AI Transformed Dormant Bugs into Immediate Threats

As security teams and web administrators scrambled to patch newly public PHP vulnerabilities this week, criminal hackers rapidly attempted to exploit the flaws in the wild. According to analysis from Cloudflare, millions of exploitation attempts were recorded within hours of the vulnerabilities being published. This surge is unsurprising given the broad access to AI tools, which significantly lower the barrier for attackers to quickly identify and exploit software weaknesses. The incident, collectively dubbed PHP2Shell, highlights a shifting dynamic in cybersecurity where artificial intelligence accelerates the lifecycle of vulnerability exploitation. While the feared mass victim takeovers have not yet materialized, the PHP Foundation reports no successful exploitation of the bugs so far. Many publicly circulating exploits appear ineffective. However, the most critical role of AI in this chaos was not in the attack itself, but in the discovery. Advanced AI models helped researchers uncover practical exploitation methods for vulnerabilities that had been known, at least in part, for years. In essence, AI transformed a historic, dormant vulnerability into a current, actionable crisis. Researchers at security firm Calif were the first to identify the PHP2Shell vulnerabilities and create exploits in early August. They utilized frontier AI tools as part of OpenAI’s Patch the Planet program, combined with expert human knowledge of PHP’s dynamics. Some underlying issues were identified in 2024 but were deemed too complex for human exploitation at the time. Following Calif’s discovery, researchers at OpenAI and Google-owned security firm Wiz independently identified the flaws using similar AI-assisted methodologies. Sagi Tzadik, a security researcher at Wiz, noted that the vulnerability had been known to the PHP team for years but was not addressed because it could not be leveraged by a human attacker. This case underscores that while no software is perfect, the expanding capabilities of AI models have drastically reduced the time required to analyze and potentially exploit vulnerabilities. This places immense pressure on under-resourced IT teams and developers to keep pace with the accelerating threat landscape. For context, Microsoft’s security updates included a record 1,453 security vulnerabilities this month alone, while Bank of America recently hired 1,000 consultants to fix flaws discovered by Anthropic’s Mythos. Security experts emphasize that AI is not creating new types of threats but rather magnifying existing dynamics of vulnerability discovery and coordinated disclosure. Jake Williams, vice president of research and development at Hunter Strategy and a former NSA hacker, stated that while more long-life bugs will likely be found, there is a limit to this "low-hanging fruit." He noted that PHP has a unique and vast attack surface, as most other tools are not exposed to the internet by design. Furthermore, researchers highlight that even with frontier models, sophisticated AI-aided hacking still relies heavily on human expertise. Ryan Austin, the Calif researcher who first discovered the PHP flaws, wrote that no model is currently capable of unearthing all bugs with simple prompts. Niels Provos, a security engineer and researcher, advised against panic, stating that it has taken a highly skilled team and over a year of AI-assisted searching to find such a critical flaw. He remains skeptical that AI will overwhelm the industry with newly exploitable historic bugs, suggesting that human ingenuity remains a crucial component in both discovery and defense.