The PHP Meltdown Shows How AI Makes Bugs More Exploitable

Judgment

PHP Foundation maintainers and downstream web admins must decide whether to redirect scarce patching capacity toward long-known PHP2Shell flaws before effective exploits circulate, trading routine maintenance for faster exposure reduction despite unproven mass exploitation.

Basis

Cloudflare analysis found millions of exploitation attempts within hours of the PHP bugs being published, while the PHP Foundation said it had not seen successful exploitation of PHP2Shell and many circulating exploits appeared ineffective. Calif researchers first identified PHP2Shell and created exploits in early August, partly with frontier AI tools through OpenAI’s Patch the Planet program and with human PHP expertise; some underlying issues were identified in 2024 but deemed too complex to exploit then. OpenAI and Wiz independently discovered the flaws with AI tools. Wiz’s Sagi Tzadik said the vulnerability had been known to the PHP team for years but was not addressed because an attacker—at least a human one—could not leverage it. Microsoft’s security updates included a record 1,453 vulnerabilities this month, and Bank of America hired 1,000 consultants to fix flaws found by Anthropic’s Mythos. Jake Williams said more long-life bugs will appear but low-hanging fruit is limited and PHP’s internet exposure is unusually broad; Ryan Austin cautioned that no model can unearth all bugs with simple prompts, and Niels Provos said finding this one required a highly skilled team after people had been looking with AI for over a year.