Security researchers have employed artificial intelligence to discover critical vulnerabilities in the PHP web scripting language, a development that has prompted widespread patching and heightened concerns about the speed at which exploits can be developed. The flaws, which had existed for years within the code that powers a significant portion of the internet, were identified by AI models used by cybersecurity firms such as Calif and Wiz. These vulnerabilities, collectively known as PHP2Shell, allow for remote code execution, potentially enabling attackers to seize control of websites, steal data, or disrupt services.
The discovery highlights a dual nature of AI in cybersecurity. While AI tools can significantly aid researchers in identifying complex security flaws that might elude human analysis, they can also be leveraged by malicious actors to accelerate the creation of exploit tools. This means the window between a vulnerability's disclosure and its widespread exploitation is shrinking, creating a more challenging environment for defenders. Amazon reported detecting an attempted exploit against a decoy server on October 17, four days before public disclosure, indicating that exploitation attempts were underway even before the vulnerabilities were widely known. Cloudflare recorded millions of exploit attempts following the announcement.
The underlying flaws in PHP had been present for decades, with some dating back as far as 2004, but the complexity of exploiting them made them impractical for human researchers. AI models, however, were able to analyze codebases and identify exploitable paths more efficiently. For instance, Calif researchers used OpenAI's GPT-5.6 Sol to pinpoint a flaw in PHP's memory allocation logic, while Wiz independently discovered multiple vulnerabilities using AI tools. This AI-assisted discovery process has been described as a "Defender's Window," allowing for fixes to be prepared before public disclosure, though the rapid development of offensive capabilities remains a significant concern.
In response to the vulnerabilities, the PHP Foundation released emergency security updates, urging all users to patch their systems immediately. Government agencies and organizations worldwide, including those in the Netherlands, Finland, France, the United Kingdom, and Japan, took precautionary measures, temporarily disabling some government websites to apply the necessary patches. The U.S. National Security Agency (NSA) also issued a warning, advising organizations to take PHP-based systems offline if immediate patching was not possible. Cybersecurity experts emphasize that while AI can aid in finding vulnerabilities, it is the combination of AI's analytical power with human expertise, rigorous testing, and responsible disclosure that is essential for effective cybersecurity.