PHP2Shell drew millions of exploit attempts; none succeeded, foundation says
Original title: The PHP Meltdown Shows How AI Makes Bugs More Exploitable
Cloudflare saw millions of attempts within hours, while Calif, OpenAI and Wiz say AI helped turn long-known PHP issues into practical exploits.
WIRED's Kernel Panic newsletter reports that criminal hackers tried to exploit newly public PHP bugs, collectively called PHP2Shell, within hours of publication. Cloudflare analysis counted millions of attempts, but the PHP Foundation says it has not seen successful exploitation and many circulating exploits appear ineffective. Calif found the issues in early August, partly with frontier models in OpenAI's Patch the Planet program; OpenAI and Wiz later found related flaws with AI. Some underlying issues were identified in 2024 and then judged too complex to exploit.
Unconfirmed: Cloudflare reports millions of attempts, while the PHP Foundation reports no successful exploitation and says many public exploits look ineffective.
- Calif identified PHP2Shell and built exploits in early August.
- Wiz says the PHP team knew the issue for years because humans could not exploit it.
- Microsoft's updates this month included a record 1,453 vulnerabilities.
- Bank of America hired 1,000 consultants for flaws found by Anthropic's Mythos.
Impact: Attempted exploitation of newly public PHP bugs
| Product | Affected |
|---|---|
| PHP Foundation PHP | — |
- 1.Patch the newly public PHP bugs that administrators were scrambling to fix.
- Products
- PHP
- Organizations
- PHP FoundationCloudflareCalifOpenAIWiz
From the original article
3 min read at wired.com
Security researchers used AI tools to help uncover years-old vulnerabilities in the PHP web scripting language. Then the AI-assisted attacks began.
By Lily Hay Newman, Matt Burgess · wired.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.