The recent discovery and rapid exploitation attempts of critical PHP vulnerabilities, dubbed PHP2Shell, highlight how AI tools are making it easier for attackers to leverage long-standing software flaws. While widespread breaches haven't occurred yet, the incident underscores a growing challenge for cybersecurity: AI is amplifying the potential impact of existing vulnerabilities.
In the wake of the PHP bugs going public, security teams and web administrators faced a surge of millions of attempted exploits within hours, according to Cloudflare. This rapid escalation is partly attributed to the increased accessibility of AI tools, which can significantly speed up the process for malicious actors to weaponize newly found weaknesses.
Interestingly, advanced AI models also played a crucial role in helping researchers uncover practical ways to exploit these PHP vulnerabilities. Some of these issues were known for years but were previously considered too complex to exploit. AI, therefore, helped transform these historic, dormant vulnerabilities into a present-day crisis, demonstrating its dual-edged nature in cybersecurity.
Researchers from Calif were the first to identify PHP2Shell and develop exploits, partly using AI as part of OpenAI’s Patch the Planet program, combined with deep human expertise. Independently, researchers at OpenAI and Wiz also used AI tools to discover similar flaws. Wiz security researcher Sagi Tzadik noted that a vulnerability known for years was only addressed after AI enabled its practical exploitation.
This trend puts immense pressure on under-resourced IT teams and developers, as AI accelerates the discovery and potential exploitation of software flaws. While AI isn't introducing entirely new types of vulnerabilities, it's magnifying the existing dynamics of discovery and disclosure. Experts like Jake Williams suggest we'll see more of these long-standing bugs becoming exploitable, particularly with widely used tools like PHP that have a vast attack surface.
However, the consensus among security experts is that AI-assisted hacking still heavily relies on human expertise. Ryan Austin, the Calif researcher who first found the PHP flaws, emphasized that AI models, at least for now, cannot uncover all bugs with simple prompts. Niels Provos, a security engineer, advises against immediate panic, suggesting that the specialized skills and time required to weaponize these vulnerabilities, even with AI, mean widespread, AI-driven mass exploitation of historical bugs is unlikely in the immediate future.
