What changed
Security researchers used advanced AI tools to uncover and exploit long-known PHP vulnerabilities, leading to a surge in exploitation attempts. According to Cloudflare's analysis, millions of attacks targeted the PHP2Shell vulnerabilities within hours of their public release. The PHP Foundation reported no successful exploitation so far, but many potential exploits are circulating.
What this means in practice
AI models played a critical role in helping researchers turn historic vulnerabilities into current threats. Researchers at Calif, OpenAI, and Wiz independently discovered the PHP2Shell flaws using AI tools, with some issues having been identified as early as 2024.
The vulnerabilities, which were known to the PHP team for years, were deemed too complex to exploit until AI made it feasible.
Limitations and availability
While AI significantly accelerated the discovery and exploitation of vulnerabilities, it is not a standalone solution. Most sophisticated AI-aided hacking still requires human expertise. Ryan Austin, a Calif researcher, noted that no model is capable of uncovering all bugs with simple prompts.
Security experts emphasize that AI is magnifying existing dynamics rather than introducing new threats. Niels Provos, a security engineer, suggested that the current situation does not signal an overwhelming threat, as finding these bugs required highly skilled teams.
