Trusence Every claim has a source
Last updated 25 October 2026 Search Türkçe
Security

AI Tools Speed Up Exploits of Long-Known PHP Flaws

The bugs remain unexploited so far, but AI is shortening the time between disclosure and attack for under-resourced teams.

25 October 2026 1 min read
A cracked brick in a stone wall beside a brass stopwatch whose hands race forward, on a dim workbench.
AI-generated illustration

Security researchers say AI tools made it far quicker to turn long-known PHP flaws, collectively called PHP2Shell, into working exploits, and millions of attack attempts reached them within hours of publication, according to Cloudflare. The bugs were first identified in early August by Calif, with later independent discoveries by OpenAI researchers and Wiz, and some of the underlying issues were flagged in 2024 but judged too complex to exploit at the time. The PHP Foundation reports no successful exploitation so far, and many public exploit attempts appear ineffective. Experts stress that human expertise still drives the most sophisticated AI-assisted hacking, and that AI mainly amplifies existing patterns of vulnerability discovery rather than creating new ones, though it adds pressure on under-resourced IT and development teams.

Why it matters

For people who run PHP software, the change is mainly one of timing: flaws that were once judged too complex to exploit are now being turned into working attacks faster, and attempts began arriving within hours of publication. Researchers say AI amplifies existing patterns of vulnerability discovery rather than creating new kinds of weakness, and that skilled humans still drive the most sophisticated attacks. Teams with limited staff face the most pressure to respond quickly.

Series Critical PHP flaws

  1. 25 Oct AI Tools Speed Up Exploits of Long-Known PHP Flaws
  2. 23 Oct PHP publishes interim mitigation for unpatched remote code execution flaw
  3. 23 Oct IT teams scramble to patch critical PHP flaw as no large breaches are confirmed
  4. 23 Oct Early leak of two critical PHP flaws forces disclosure to move up a day
  5. 22 Oct PHP flaws prompt urgent patching across the web as attack attempts climb
  6. 22 Oct Attacks on PHP2Shell flaws began four days before patches shipped, Amazon says
The whole series · 11 stories →

Sources · 1

Checked against its sources before publishing · 25 October at 11:19