PHP Bug Disclosure Shows How AI Speeds Up Exploit Writing

Security teams raced this week to patch a set of newly disclosed vulnerabilities in the PHP scripting language after criminal hackers attempted exploitation within hours of the flaws becoming public, according to analysis from Cloudflare cited by Wired. Cloudflare recorded millions of exploitation attempts in that window, the outlet reported.

The bugs, collectively dubbed PHP2Shell, had been known in part since 2024 but were considered too complex to exploit at the time, according to Wired. The PHP Foundation says it has not seen any successful exploitation of the flaws, and many exploit code samples circulating publicly appear to be ineffective, Wired reported.

Who found the PHP2Shell bugs first

Researchers at the security company Calif were the first to identify the PHP2Shell vulnerabilities and build working exploits in early August, Wired reported. The work drew partly on frontier AI tools through OpenAI's Patch the Planet program, combined with human expertise in PHP's internal mechanics, according to the outlet. Following Calif's disclosure, researchers at OpenAI and the Google-owned security firm Wiz independently found PHP2Shell flaws using AI tools, Wired reported.

Why AI mattered more for defenders than attackers so far

Sagi Tzadik, a security researcher at Wiz, told Wired that PHP's own team had known about the underlying vulnerability for years but had not prioritized a fix because exploiting it required a level of analytical work beyond what a human attacker could practically carry out on their own — a barrier that AI tools helped researchers clear first. Jake Williams, vice president of research and development at Hunter Strategy and a former NSA hacker, told Wired: "We'll definitely see more of these long-life bugs that are in every version of the software for the last decade or whatever. But I think there's only so much of this low-hanging fruit. There isn't much else that has the same..."

Is this a new kind of threat or an old one sped up

Security researchers interviewed by Wired stressed that AI is not introducing a fundamentally new attack technique but is accelerating existing processes of vulnerability discovery and disclosure. That acceleration cuts both ways: the same tools that let Calif, OpenAI, and Wiz researchers surface practical exploits also shortened the window between public disclosure and attempted criminal exploitation, according to the outlet.

How this is straining IT and security teams

The PHP episode lands amid a broader rise in disclosed flaws. Microsoft's security updates this month included a record 1,453 vulnerabilities, Wired reported. Separately, Bank of America recently hired 1,000 consultants to address flaws discovered by Anthropic's Mythos tool, according to the outlet — evidence, researchers say, of under-resourced teams struggling to keep pace with AI-assisted bug discovery on both sides of the fence.

What to watch

• Whether PHP2Shell exploitation attempts succeed against unpatched servers in the coming weeks.
• Whether the PHP Foundation issues further guidance beyond the initial patches.
• Whether other AI-assisted research groups surface additional long-dormant bugs in widely used software.
• How enterprises staff up to triage AI-accelerated disclosure volumes, following Bank of America's consultant hiring.

mindfulAI Keyboard — An iPhone keyboard that rewrites a draft in a tone you pick. Four free AI actions a day.