AI Tools Unearth PHP Flaws, Spark Rapid Exploitation

Security researchers using AI tools uncovered years-old vulnerabilities in the PHP web scripting language, dubbed PHP2Shell, prompting rapid exploitation attempts by criminal hackers within hours of disclosure, though no successful mass breaches have been reported. The flaws, partially identified in 2024 but deemed too complex to exploit, were first weaponized by security firm Calif in August using frontier AI models and expert knowledge. OpenAI and Google-owned Wiz independently discovered similar issues, with AI enabling practical exploitation of vulnerabilities previously considered unaddressable. Experts caution that AI magnifies existing vulnerability discovery dynamics rather than creating entirely new threats, noting most sophisticated AI-aided hacking still requires human expertise. While more long-lived bugs may emerge, researchers suggest limited low-hanging fruit exists, with PHP's unique internet exposure being exceptional.