The PHP Meltdown Shows How AI Makes Bugs More Exploitable
Millions of exploitation attempts hit within hours of new PHP bugs being published, as AI tools make it easier for attackers to quickly exploit flaws.
As security teams and web admins scrambled this week to patch newly public PHP bugs, criminal hackers quickly attempted to exploit the flaws in the wild. The PHP Foundation says it hasn't seen any successful exploitation of the bugs, collectively dubbed PHP2Shell, and many publicly circulating potential exploits appear to be ineffective.
AI Turns Known Flaws Into Current Crisis
The most interesting role of AI amid the chaos this week is how advanced models helped researchers uncover practical exploitations for vulnerabilities that were known about, at least in part, for years. Researchers at security company Calif were the first to identify the PHP2Shell vulnerabilities and create exploits in early August—partially using frontier AI tools as part of OpenAI's Patch the Planet program.
The vulnerability had been known to the PHP team for years, but because it could not be leveraged by an attacker—at least, not a human one—it was not addressed.
Expanding Attack Surface
The expanding capabilities of AI models have made it faster to analyze and potentially exploit vulnerabilities, putting more pressure on under-resourced IT teams. Microsoft's security updates included a record 1,453 security vulnerabilities this month alone. Bank of America recently hired 1,000 consultants to fix flaws discovered by Anthropic's Mythos.
Security researchers emphasize that AI is ultimately not doing anything new, but rather magnifying existing dynamics of vulnerability discovery and coordinated disclosure.
Human Expertise Still Essential
Researchers note that even with frontier models, most examples of sophisticated AI-aided hacking also involve human expertise. As Ryan Austin, the Calif researcher who first discovered the PHP flaws, wrote this week, "No model is simply capable of unearthing 'all bugs' with simple prompts." Security engineer Niels Provos suggests people can dial back their concerns about AI finding an overwhelming number of newly exploitable historic bugs.
Related
