Millions of attempts to exploit newly public PHP vulnerabilities arrived within hours of their disclosure, according to Cloudflare analysis cited by WIRED. The flaws, collectively called PHP2Shell, prompted security teams and web administrators to rush out patches.
So far, there is no reported mass breach. The PHP Foundation says it has not seen a successful exploitation of the bugs, and many exploits circulating publicly appear ineffective. WIRED does not identify the affected PHP versions or give patch instructions.
AI helped researchers find a way in
Researchers at security company Calif first identified the vulnerabilities and built exploits in early August, using frontier AI tools in part through OpenAI’s Patch the Planet program. Their work also relied on human expertise in PHP. Researchers at OpenAI and Google-owned Wiz later found PHP2Shell flaws independently using AI tools.
Some underlying issues had been identified in 2024 but were considered too difficult to exploit. Wiz researcher Sagi Tzadik said the PHP team had known about the vulnerability for years, but had not addressed it because it could not be used by a human attacker. AI helped make a previously impractical flaw actionable.
More pressure, not automatic hacking
The episode shows how AI can speed up vulnerability analysis and exploitation, adding pressure on security teams already managing large volumes of flaws. WIRED notes that Microsoft’s security updates included a record 1,453 vulnerabilities that month, and that Bank of America hired 1,000 consultants to address flaws found by Anthropic’s Mythos.
Researchers quoted by WIRED caution against assuming AI will uncover every old bug. Calif researcher Ryan Austin said no model can find all bugs with simple prompts; other experts stressed that the PHP discovery required a skilled team. One researcher also noted that PHP’s broad exposure to the internet makes it an unusual target, rather than proof that every old software flaw is about to become exploitable.
Why it matters
For administrators responsible for PHP systems, WIRED’s account is a reason to take publicly disclosed flaws seriously: attempts arrived quickly, even though successful attacks have not been reported. WIRED does not specify affected versions or patches, so administrators will need to check official PHP guidance rather than infer whether their systems are exposed.
