AI-assisted exploit turns PHP memory error into server code execution
Original title: AI is forcing us to pay off 40 years of technical debt
PHP2Shell vulnerability in legacy PHP allows arbitrary code execution via out-of-memory error, discovered and patched with AI tools before any exploitation.
A vulnerability in PHP allows out-of-memory errors to be exploited for arbitrary code execution on the host server. The flaw was reported to the PHP Foundation in 2024 and patched before bad actors could use it. Major sites including NASA and Wikipedia run on affected PHP versions. AI tools aided discovery of the exploit path.
- Reported in 2024 as a simple memory error
- Exploited in 2025 by researchers at Calif using AI
- Affects all sites running PHP on Wordpress or Drupal
- Patch released by PHP Foundation before exploitation
Impact: arbitrary code execution and sensitive data read on host server
- Vendors
- PHP
From the original article
5 min read at spectrum.ieee.org
In late October, a slew of major cybersecurity issues came to light. But none were bigger than the so-called PHP2Shell vulnerability , which put a plethora of websites, including those of NASA , Wikipedia , the White House, and all other sites that run on Wordpress or Drupal (among others) at risk of exploits capable of both reading sensitive data and running malicious code on the host server.
By pseudolus · spectrum.ieee.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.