AI Found a 20-Year-Old PHP Flaw—Then the Internet Raced to Survive It
AI Found a 20-Year-Old PHP Flaw—Then the Internet Raced to Survive It
In mid-August, researchers at AI firm Calif and Google-owned Wiz identified two critical flaws in PHP, the decades-old language used by roughly 70% of websites with known server-side code. The bugs, later dubbed PHP2Shell, could let unauthenticated attackers run code on a vulnerable server—opening a path to stolen data, altered sites and deeper network access.
The underlying weaknesses had existed for years, but researchers said exploiting them once required an “exceptionally complex chain of steps.” AI changed that calculation. Wiz warned that the same capability that uncovered the flaws could help attackers rapidly build offensive tools, while security experts said the traditional gap between a vulnerability’s discovery and a usable exploit was closing.
The danger became immediate before the planned patch. Amazon Threat Intelligence detected an attempted PHP2Shell exploit on October 17. Then, after details leaked in forums and a proof-of-concept video briefly appeared online, the PHP Foundation brought its release forward by a day, issuing patches at 10 a.m. ET on Wednesday.
Governments and companies responded with a blunt precaution: go dark if they could not patch. Britain said 32 government services were taken offline; sites in Finland, the Netherlands, Germany and Japan were also disrupted. For users, the outage was not abstract—Helsinki resident Kalle Pusa could not arrange collection of an old sofa, saying the digital services woven into society had briefly been “torn.”
Cloudflare saw the attackers’ interest surge from thousands of attempts before disclosure to millions afterward. Yet the PHP Foundation said it had no evidence of successful remote-code execution, and Dataminr reported activity was still limited to scanning and non-working exploits as of Thursday.
For defenders, the practical message was patch first, investigate second—especially for neglected legacy systems that cannot receive official fixes. AI-assisted tools are already being pitched as part of that response: Perplexity’s Aravind Srinivas said users could receive credits to check PHP exposure. But the crisis left a harsher lesson: AI may find the next hidden flaw sooner, and give everyone else less time to react.
Write a comment