PHP2Shell vulnerabilities show how AI speeds up exploitation of old flaws

What happened

In recent weeks, security teams and server administrators rushed to patch a set of PHP flaws dubbed PHP2Shell. According to Cloudflare's analysis, millions of exploitation attempts arrived within hours of the public disclosure of the vulnerabilities, according to Wired's report.

As of Wired's publication, the catastrophic scenario hadn't been confirmed: the PHP Foundation says it has not recorded any successful exploitation of the flaws, and much of the exploits circulating publicly proved ineffective. But the episode drew attention for a reason different from the usual patch panic: the role of advanced AI models in turning a vulnerability known for years into an actually exploitable crisis.

In short: the bug wasn't new. What changed was the speed and depth with which it could be analyzed and turned into a functional exploit.

How AI entered the picture

Researchers at security firm Calif were the first to identify the PHP2Shell flaws and build functional exploits in early August, using cutting-edge AI tools as part of OpenAI's Patch the Planet program, combined with specialized human knowledge of PHP and its internal quirks. Part of the underlying issues had already been identified in 2024, but were considered too complex to exploit at the time.

After Calif's discovery, researchers from OpenAI itself and from Wiz, Google's security company, independently found PHP2Shell flaws using AI tools. Sagi Tzadik, a security researcher at Wiz, summed up the problem:

The vulnerability had been known to the PHP team for years, but because it could not be leveraged by an attacker—at least, not a human one—it was not addressed.

Sagi Tzadik, security researcher at Wiz

In other words: the technical risk already existed in the code. What was missing was someone, or something, capable of assembling the exploit chain all the way through.

The pattern experts see

Jake Williams, vice president of research and development at Hunter Strategy and a former NSA hacker, describes PHP2Shell as part of a larger trend, but points to an important limit to it:

We'll definitely see more of these long-life bugs that are in every version of the software for the last decade or whatever. But I think there's only so much of this low-hanging fruit. There isn't much else that has the specific reach of PHP. It's a pretty wild attack surface, most other tools aren't exposed to the internet by design.

Jake Williams, VP of research and development at Hunter Strategy

The central argument is that AI isn't creating a new type of vulnerability. It's speeding up a discovery process that already existed, doing so faster over a specific universe of software with decades of accumulated code and direct internet exposure, as is the case with PHP.

Humans are still necessary, say the researchers themselves

Ryan Austin, the Calif researcher who originally discovered the flaws, posted a warning against overreading the case:

No model is simply capable of unearthing 'all bugs' with simple prompts. At least for now.

Ryan Austin, researcher at Calif

Niels Provos, a security engineer and researcher, goes in the same direction and downplays the fear of an uncontrolled wave of old flaws reactivated by AI:

To be honest, I'm not too worried. People have already been searching with AI for more than a year, and it took a highly skilled team to find this bug. I guess we'll see if I'm completely wrong, but I doubt it.

Niels Provos, security engineer and researcher

The scale of the problem isn't just PHP

The PHP2Shell case isn't an isolated event on the October 2026 calendar. According to Wired, Microsoft's security updates this month included a record 1,453 vulnerabilities fixed at once. In another case cited by the report, Bank of America hired a thousand consultants to fix flaws found by Mythos, Anthropic's security system.

The picture these three episodes form together is consistent: AI tools are expanding the volume of vulnerabilities found in parallel across multiple organizations, putting pressure on security and development teams that already operate with limited resources. This applies both to those who hunt bugs and to those who need to fix them afterward.

What changes for PHP developers in Brazil

PHP still underpins a huge slice of the Brazilian web, from legacy WordPress installs to enterprise systems built on Laravel or older in-house frameworks. The PHP2Shell case leaves a very concrete practical point: code that ran without incident for years may be sitting on a known flaw that was previously considered impractical to exploit.

For those who maintain PHP applications in production, three shifts in posture make sense based on this case:

• Review the history of CVEs for PHP and third-party libraries even when they were classified as low practical risk in the past, since that classification can change with more capable analysis tools.
• Prioritize patch speed over long approval cycles for components directly exposed to the internet, given that the window between disclosure and mass exploitation is now measured in hours.
• Actively monitor exploitation attempts (as Cloudflare did in the PHP2Shell case) instead of relying solely on patching as the single line of defense.

The episode doesn't prove that AI created a new category of threat. It proves that the time between a "known theoretical bug" and a "functional exploit in production" got shorter, and that this interval tends to keep shrinking on any stack with an attack surface large enough to be worth the computational effort.