AI-Assisted Attacks Turn PHP Bugs Into Security Crisis

Security researchers used AI tools to help uncover years-old vulnerabilities in the PHP web scripting language, and then AI-assisted attacks began. The episode matters because it shows how AI can turn historic bugs into current exploits, according to WIRED.

What happened

WIRED reported that security teams and web admins scrambled this week to patch newly public PHP bugs. Criminal hackers quickly attempted to exploit the flaws in the wild. According to analysis from Cloudflare, millions of exploitation attempts hit within hours of the vulnerabilities being published. The PHP Foundation said it had not seen any successful exploitation of the bugs, collectively dubbed PHP2Shell, and many publicly circulating potential exploits appeared ineffective.

The report described a nightmare scenario in which mass victim takeovers and breaches might follow. So far, that outcome had not come to pass. The most interesting role of AI amid the chaos was how advanced models helped researchers uncover practical exploitations for vulnerabilities that were known about, at least in part, for years. In other words, AI helped turn a historic vulnerability into a current crisis. The full report is at https://www.wired.com/story/kernel-panic-the-php-meltdown-shows-how-ai-makes-bugs-more-exploitable/.

Why AI made the bugs more exploitable

Researchers at the security company Calif were the first to identify the PHP2Shell vulnerabilities and create exploits in early August, partially using frontier AI tools as part of OpenAI’s Patch the Planet program, but also using expert human knowledge of PHP, its dynamics and weaknesses. Some underlying issues were identified in 2024 but were deemed too complex to exploit at the time. Following Calif’s discovery, researchers at OpenAI and the Google-owned security firm Wiz independently discovered PHP2Shell flaws using AI tools, according to WIRED.

Sagi Tzadik, a security researcher at Wiz, said the vulnerability had been known to the PHP team for years, but because it could not be leveraged by an attacker, at least not a human one, it was not addressed.

The report noted that no software is perfect, and that AI’s expanding capabilities had made it faster to analyze and potentially exploit vulnerabilities. That put more pressure on under-resourced IT teams, developers and admins. Microsoft’s security updates included a record 1,453 security vulnerabilities this month alone, while Bank of America recently hired 1,000 consultants to fix flaws discovered by Anthropic’s Mythos.

How attackers responded

After the vulnerabilities were published, criminal hackers quickly attempted to exploit the flaws. Millions of exploitation attempts hit within hours, according to Cloudflare. AWS logged attempts to leverage the bugs four days before they were patched, WIRED reported. The PHP Foundation said it had not seen successful exploitation, and many potential exploits appeared ineffective.

Researchers said even with frontier models, most sophisticated AI-aided hacking also involved human expertise. Ryan Austin, the Calif researcher who first discovered the PHP flaws, wrote that no model was simply capable of unearthing all bugs with simple prompts, at least for now.

What it means for AI security and defenders

Security researchers emphasized that AI is ultimately not doing anything new, but rather magnifying existing dynamics of vulnerability discovery and coordinated disclosure. Jake Williams, vice president of research and development at Hunter Strategy and a former NSA hacker, said more long-life bugs could appear in software that has been around for a decade or whatever. He said there may not be much else with the specific reach of PHP, calling it a pretty wild attack surface.

Niels Provos, a security engineer and researcher, said he was not really worried about AI finding an overwhelming number of historic bugs that became newly exploitable, or new vulnerabilities that could not have been practically exploited without AI. He said people had been looking with AI for over a year, and it required a highly skilled team to find this one.

How Grafy fits

For developers interested in AI-assisted coding or AI-assisted security workflows, Grafy Code is the relevant Grafy surface, though it is an AI coding studio rather than a dedicated vulnerability research platform. A developer could use AI coding assistance to review code or test secure patterns, but the report notes that sophisticated AI-aided hacking often still involves human expertise. For broader model comparison, a reader could also explore Grafy Chat.

Frequently asked questions

Did AI create the PHP vulnerabilities?

According to WIRED, the AI tools helped researchers find practical exploits for PHP flaws that were known, at least in part, for years. The report does not say AI invented the bugs. It describes AI as changing how quickly and feasibly those flaws could be analyzed and exploited, while human expertise remained central.

Were the PHP bugs successfully exploited?

The PHP Foundation said it had not seen successful exploitation of the PHP2Shell bugs. WIRED reported that many publicly circulating potential exploits appeared ineffective, and no mass victim takeovers had come to pass at the time of writing. Millions of attempts were logged, but outcomes were limited.

What does AI-assisted hacking mean for defenders?

Security researchers said AI is not doing anything entirely new, but it is magnifying existing dynamics of vulnerability discovery and disclosure. The PHP episode added pressure on under-resourced teams. Experts said more long-life bugs may appear, though highly skilled human teams were still needed to turn AI findings into exploits.

---

Source: WIRED — AI — The PHP Meltdown Shows How AI Makes Bugs More Exploitable