AI-assisted discovery accelerates exploitation of long-known PHP vulnerabilities

Security researchers used frontier AI tools—including those from OpenAI’s Patch the Planet program—to uncover practical exploitations for long-known vulnerabilities in PHP, collectively dubbed PHP2Shell. The underlying issues had been identified as early as 2024 but were previously deemed too complex to exploit by human analysts alone.

Following the initial discovery by security firm Calif in early August, researchers at OpenAI and Google-owned Wiz independently identified the same PHP2Shell flaws using AI assistance. The vulnerabilities had been known to the PHP team for years but were not addressed because they were not practically exploitable by human attackers at the time.

Within hours of public disclosure, millions of exploitation attempts were recorded by Cloudflare, underscoring the speed at which AI-assisted attacks can scale. Despite the volume, the PHP Foundation reported no confirmed successful exploitation of the bugs, and many circulating exploits appeared ineffective.

Experts note that AI does not introduce fundamentally new risks but magnifies existing dynamics of vulnerability discovery and coordinated disclosure. Sagi Tzadik, a researcher at Wiz, stated that the expanding capabilities of AI models have made it faster to analyze and potentially exploit vulnerabilities, increasing pressure on under-resourced IT teams and developers to keep pace with patching cycles.

Microsoft disclosed a record 1,453 security vulnerabilities in a single month, while Bank of America recently hired 1,000 consultants to address flaws identified with the help of Anthropic’s Mythos. Researchers caution that while AI can accelerate discovery and exploitation, most sophisticated AI-aided hacking still requires human expertise to succeed.

Jake Williams, vice president of research and development at Hunter Strategy and a former NSA hacker, predicted that more long-lived bugs will emerge, though PHP’s broad exposure to the internet makes it an outlier. Niels Provos, a security engineer and researcher, downplayed concerns about AI overwhelmingly increasing exploitable vulnerabilities, noting that highly skilled teams were required to uncover the PHP flaws and that similar discoveries remain rare even after a year of AI-assisted research.