AI Found the PHP Flaw First—Now the Web Is Racing the Attackers
AI Found the PHP Flaw First—Now the Web Is Racing the Attackers
In August, researchers at Calif and Google’s Wiz independently used advanced AI models to uncover related flaws in PHP, the decades-old web language used by an estimated 70% of websites. Wiz researcher Sagi Tzadik initially doubted the finding—“Models tend to hallucinate”—but the exploit worked, exposing a weakness that had apparently sat unnoticed for more than a decade.
The researchers coordinated with the PHP Foundation and prepared patches. That was the defensive success. The danger was the clock: word of the vulnerabilities leaked before the planned release, and an accidentally posted demonstration helped spur copycat activity. Cloudflare recorded thousands of exploit attempts before the public announcement, then tens of thousands within 45 minutes, hundreds of thousands within two hours and eventually millions.
By Wednesday and Thursday, governments and companies were choosing disruption over exposure. Britain took 32 public services offline; Finland’s public websites briefly halted even routine tasks; sites in Germany, Japan and the Netherlands were also affected. For Kalle Pusa, a Helsinki software developer trying to arrange collection of an old sofa, the outage underscored the stakes: digital services are “woven into the fabric of our society,” and that fabric had been “torn.”
The immediate threat was to servers, not ordinary visitors’ phones or laptops. Still, the flaws could allow attackers to run code without logging in—potentially stealing data, altering websites or using compromised servers to reach deeper into networks. Security guidance was blunt: patch PHP itself, inventory exposed systems and take a site offline if it cannot be secured quickly.
That response exposed a divide in capacity. Large institutions could treat an outage as a “speed bump,” while some small businesses lost service for up to seven hours. Cybersecurity specialists warn that this imbalance may worsen as AI compresses reconnaissance and exploitation from weeks into minutes. One expert argued that the old remediation sequence is “broken,” because less-skilled attackers can now wield these flaws quickly with AI agents.
The patching campaign is now itself being automated: Aravind Srinivas said his company was offering credits for a tool to check PHP exposure and prioritize fixes. That is the central tension of PHP2Shell: AI gave defenders the early warning, but it also made speed—not merely technical skill—the decisive security advantage.
Write a comment