Researchers warn PHP2Shell bugs could be easier to exploit with AI

In short: Security researchers disclosed critical PHP2Shell vulnerabilities in PHP, and warned that modern AI tools can make them easier to turn into real attacks.

What happened

Researchers from OpenAI, Wiz, and Calif disclosed a set of security flaws they call PHP2Shell. The flaws affect PHP, a common programming language used to run many websites. If a site is vulnerable, an attacker could potentially run their own code from afar, knock the site offline, or access private data.

The PHP Foundation released a patch, which is an update that fixes the problem. It urged website owners and hosting providers to apply the update quickly.

Researchers said the underlying flaws had existed for years. What changed, they argued, is that showing how to exploit them required a long and complicated chain of steps. They said frontier AI models lowered the effort needed to complete those steps, making the attack path more practical.

Why it matters

PHP runs behind the scenes on a large share of the internet. That means a serious bug in PHP can ripple out to many everyday services people rely on, like shopping sites, forums, and business portals.

This case also highlights a “dual use” problem. AI can help defenders find and fix bugs faster, but it can also help attackers move from “a weakness exists” to “here is how to break in” more quickly. For most organizations, the immediate takeaway is simple: apply security updates fast, and regularly check which systems are exposed.

Source: NYTimes