Cash poured into patching this week as millions of exploitation attempts hit newly public PHP bugs within hours of disclosure, according to Cloudflare. Nothing appears to have broken in.
No confirmed win has surfaced yet, per the PHP Foundation, which tracks the cluster under the name PHP2Shell, and plenty of the exploit code doing the rounds on forums simply fails. The more consequential story is how the flaws became urgent at all.
Parts of the underlying code were flagged as far back as 2024 and set aside as too hard to weaponize. Researchers at security firm Calif built working exploits in early August, leaning on frontier AI models through OpenAI’s Patch the Planet program plus hands-on PHP expertise. Teams at OpenAI and Google-owned Wiz reached the same flaws independently, also with AI assistance.
Wiz researcher Sagi Tzadik drew the lesson out: the flaw had been known to the PHP team for years, but because no human attacker could leverage it, nobody fixed it. The old assumption that a defect was impractical to exploit no longer holds once a model can do the analysis.
That is the pattern worth watching. AI does not create memory-safety bugs; it collapses the cost of turning a nagging defect into a weapon. Microsoft shipped a record 1,453 fixes this month, and Bank of America put 1,000 consultants on flaws that Anthropic’s Mythos turned up.
For administrators, the arithmetic is grim. A backlog item that sat harmlessly for two years can go from curiosity to live exploit in the time it takes to read one newsletter.
