The PHP Meltdown Shows How AI Makes Bugs More Exploitable
wired ·
Security researchers utilized AI tools to uncover and exploit long-standing vulnerabilities in the PHP web scripting language, a crisis collectively dubbed PHP2Shell. Although millions of exploitation attempts were recorded shortly after the bugs became public, the PHP Foundation reports no successful breaches so far. The discovery was led by Calif researchers using OpenAI's Patch the Planet program, with independent findings from OpenAI and Wiz also relying on advanced models. Experts note that while AI accelerates the analysis of flaws, it ultimately magnifies existing dynamics rather than creating entirely new threats. Human expertise remains crucial, as frontier models cannot simply unearth all bugs through basic prompts without skilled guidance. Consequently, some security professionals argue that the panic surrounding mass victim takeovers is exaggerated given the high skill level required for such discoveries. However, the incident highlights increasing pressure on under-resourced IT teams to keep pace with rapidly evolving vulnerability landscapes.
wired