AI Helps Trigger Millions of PHP2Shell Attacks as Years-Old Bugs Turn Newly Exploitable
Updated
Updated · WIRED · Oct 24
AI Helps Trigger Millions of PHP2Shell Attacks as Years-Old Bugs Turn Newly Exploitable
3 articles · Updated · WIRED · Oct 24
Summary
Millions of exploit attempts hit newly disclosed PHP2Shell flaws within hours of publication, Cloudflare said, as attackers rapidly tested AI-assisted attack code against exposed servers.
Calif first built working exploits in August with frontier AI tools plus expert human research, showing how bugs known in part since 2024 could be turned into a practical attack path.
No successful exploitation has been confirmed so far, according to the PHP Foundation, and many public proof-of-concept exploits circulating this week appear ineffective.
Researchers say the episode reflects AI accelerating vulnerability analysis rather than replacing skilled hackers, increasing pressure on defenders already facing heavy patch loads such as Microsoft's 1,453 fixes this month.
Security experts expect more long-lived bugs to surface, but argue PHP2Shell is not proof that AI will suddenly unlock every historic flaw without substantial human expertise.