AI Tools Turn Old PHP Bugs Into Active Exploits
Original: The PHP Meltdown Shows How AI Makes Bugs More Exploitable
Why This Matters
AI is compressing the gap between vulnerability discovery and active exploitation at scale.
Millions of exploit attempts hit PHP servers within hours of PHP2Shell vulnerabilities going public in Oct 2026. AI tools helped researchers find and weaponize flaws that had existed, unexploited, for years.
When PHP2Shell vulnerabilities were publicly disclosed this week, Cloudflare logged millions of exploitation attempts within hours. The speed was no surprise: AI tools have dramatically lowered the bar for attackers to operationalize known flaws.
Security firm Calif first identified the PHP2Shell bugs in early August, using frontier AI models through OpenAI's Patch the Planet program alongside expert human knowledge of PHP internals. Some underlying issues had been flagged in 2024 but were considered too complex for practical exploitation—at the time. After Calif's disclosure, researchers at both OpenAI and Google-owned Wiz independently found the same flaws using AI.
"The vulnerability had been known to the PHP team for years, but because it could not be leveraged by an attacker—at least, not a human one—it was not addressed," said Wiz researcher Sagi Tzadik.
The PHP Foundation reports no confirmed successful exploits so far, and many circulating proof-of-concept attempts appear ineffective. Still, the episode illustrates a structural shift: AI can surface latent vulnerabilities that human researchers historically passed over as too complex. Microsoft patched a record 1,453 vulnerabilities this month alone. Bank of America recently hired 1,000 consultants to remediate flaws found by Anthropic's Mythos AI. Former NSA hacker Jake Williams cautioned that this "low-hanging fruit" won't last forever, but the window of exposure for legacy bugs is clearly widening.