AI Found PHP2Shell First, but the Internet Still Faces a Patch Race
AI Found PHP2Shell First, but the Internet Still Faces a Patch Race
Researchers at Calif and Google-owned Wiz found two critical PHP vulnerabilities—dubbed PHP2Shell—with AI assistance after the flaws had apparently persisted in the web’s underlying plumbing for years. PHP supports roughly 70% of websites with known server-side languages, including systems built around WordPress, giving the discovery an unusually broad blast radius.
The initial account from OpenAI and its partners was cautiously optimistic: frontier AI had identified the weaknesses before attackers did, while researchers worked with the PHP Foundation to prepare fixes. But that confidence collided with the practical reality of public disclosure. A leaked proof-of-concept video and online discussion accelerated the timetable, and the foundation released patches 24 hours early on Wednesday.
Governments then moved from warning to triage. The NSA told organizations to update immediately or take affected systems offline, arguing that the flaws could offer “a direct path to the server’s file system or database.” European government sites temporarily went dark, while officials in Japan urged organizations to act that night rather than gamble on a delayed fix.
The central dispute is no longer whether AI can find severe bugs. It is whether defenders can absorb what happens once those bugs become known. The PHP Foundation said it had no evidence at the time of working public exploits, only incomplete and non-working generated code. Yet Tolmo researcher Matt Suiche said his team produced a working exploit in less than a day, a task he said previously could have taken weeks.
Amazon raised the stakes further, saying its telemetry had identified an exploit attempt before the public disclosure and that the flaws were “now being broadly exploited in the wild.” That makes the patch race less a hypothetical demonstration of AI’s power than a live test of whether the internet’s oldest infrastructure can respond at machine speed.
Commercial tools are already being pitched as part of the response: Aravind Srinivas said Computer was offering credits for checks of PHP sites and deployment configurations, with the tool prioritizing fixes.
Write a comment