The PHP Meltdown Shows How AI Makes Bugs More Exploitable

THE NEWS

What happened

A recent surge in PHP vulnerabilities, dubbed PHP2Shell, demonstrates how advanced AI tools are accelerating the exploitation of long-standing software flaws. While no mass breaches have occurred yet, AI has enabled researchers to turn historic, unexploitable bugs into immediate security crises, placing immense pressure on under-resourced IT teams globally.

CONTEXT

Why it matters

The 'PHP Meltdown' reveals a critical shift in cybersecurity: AI is making old bugs new threats. Vulnerabilities known for years were deemed safe until frontier models helped researchers craft exploits, triggering millions of attack attempts within hours. While no major breaches have happened yet, the ability to rapidly analyze and weaponize historic flaws puts immense pressure on under-resourced IT teams. Experts warn that while AI isn't inventing new bugs, it is drastically accelerating the timeline for exploitation, turning 'low-hanging fruit' into urgent crises.

AT A GLANCE

Key facts

• Millions of exploitation attempts against PHP vulnerabilities hit within hours of their public disclosure, driven by broad access to AI tools.
• The PHP2Shell flaws were known to the PHP team for years but remained unaddressed because they were previously considered too complex for human attackers to exploit.
• Researchers from Calif, OpenAI, and Wiz used frontier AI models alongside expert human knowledge to identify and create exploits for these decades-old issues.
• Microsoft reported a record 1,453 security vulnerabilities in a single month, while Bank of America hired 1,000 consultants specifically to fix flaws discovered by Anthropic's Mythos model.
• Security experts emphasize that AI is magnifying existing dynamics rather than creating new types of threats, and most sophisticated attacks still require significant human expertise.