PHP2Shell Shows How AI Can Turn Longstanding Bugs Into Practical Exploits

AI changed the practical risk of PHP2Shell

The PHP2Shell flaws expose a shift in software security: a bug can remain known for years without posing a practical threat, then become exploitable as researchers gain better tools and expertise. Within hours of the flaws becoming public, Cloudflare counted millions of attempts to exploit them. The PHP Foundation said it had seen no successful exploitation, and security researchers found that many circulating exploit attempts did not work.

That combination matters. The number of attempts shows how quickly attackers can respond to newly disclosed vulnerabilities. The lack of confirmed successful attacks, meanwhile, is a reminder that attempts are not the same as working exploits or compromised systems. The episode offers a useful measure of AI’s role: it can help turn a difficult analysis into a usable attack path, but the evidence here does not show that a model alone can reliably break into vulnerable systems.

PHP is widely used and exposed through web applications, giving a flaw in the language a broad potential reach. That makes PHP2Shell unusual, according to Jake Williams, vice president of research and development at Hunter Strategy. He expects more long-lived bugs to become exploitable, but says other tools often lack PHP’s internet-facing exposure. A vulnerability’s impact depends on both what the software does and how it is deployed.

Researchers combined AI with PHP expertise

Researchers at Calif identified the PHP2Shell vulnerabilities and developed exploits in early August, using frontier AI tools in part through OpenAI’s Patch the Planet program. Their work also drew on human knowledge of PHP’s behavior and weaknesses. Researchers at OpenAI and Wiz later found flaws independently with AI tools.

Some of the underlying issues had been identified in 2024, but were considered too complex to exploit at the time. Sagi Tzadik, a Wiz researcher, said the PHP team had known about the vulnerability for years, but had not addressed it because it could not be exploited by a human attacker. Calif’s work changed that assessment by showing a practical route from the known issue to an exploit.

This is a meaningful distinction for developers and security teams. A bug report can describe a weakness without demonstrating a reliable way to use it against a real system. Researchers still have to understand the software, identify the conditions that make the flaw reachable, and test whether the proposed exploit works. AI can speed up parts of that process, but the PHP2Shell findings involved skilled researchers alongside models.

Fast exploitation attempts put pressure on defenders

Once vulnerability details and working exploit techniques become available, attackers can move quickly. The reported millions of attempts arrived within hours of disclosure, leaving administrators little time to assess exposure and apply fixes. That speed adds pressure to teams already responsible for maintaining large, complex software environments.

The workload is not limited to PHP. Microsoft’s security updates addressed a record 1,453 vulnerabilities in a single month, and Bank of America hired 1,000 consultants to fix flaws found by Anthropic’s Mythos. Those figures show the scale of the work facing organizations; they do not establish that AI caused the underlying security backlog. AI-assisted discovery may increase the pace at which teams learn about flaws, while patching still depends on finding affected systems, evaluating risk, and deploying updates.

Defenders also need to distinguish between noisy activity and demonstrated compromise. Rapid scans or exploit attempts can indicate that attackers are testing a flaw, but they do not prove that a particular system was successfully breached. In this case, the PHP Foundation reported no successful exploitation, and researchers said many publicly circulating attempts were ineffective. That is useful evidence, though it does not remove the need to check affected systems and apply available fixes.

What the case says about AI-assisted security

Researchers do not describe AI as inventing a new kind of vulnerability. Instead, it can amplify familiar work: inspecting code, reasoning about edge cases, and finding ways to connect a flaw to an attack. This can make previously impractical vulnerabilities more relevant, while also helping defenders analyze software and identify weaknesses earlier.

Ryan Austin, the Calif researcher who first found the PHP flaws, wrote that no model can uncover every bug through simple prompts. Williams likewise expects some old vulnerabilities to resurface as practical threats, while cautioning that PHP’s broad exposure makes this case an unusual one. Niels Provos, a security engineer and researcher, said finding this flaw took a highly skilled team even after researchers had spent more than a year using AI to look for vulnerabilities.

The clearest takeaway is operational: organizations should treat disclosure speed as part of their exposure planning. Teams need reliable inventories of the software they run, a way to identify which systems are affected, and a process for prioritizing fixes when exploit attempts rise. AI may shorten the time between discovering a bug and demonstrating how to exploit it. For now, PHP2Shell suggests that expert judgment remains central—and that the most consequential cases may come from software with unusually broad reach.