PHP2Shell flaw shows AI digging up decades-old PHP bugs

IEEE Spectrum reports on PHP2Shell, a vulnerability that came to light in late October. It put a large number of websites at risk, including those of NASA, Wikipedia, the White House, and all other sites running on WordPress or Drupal (among others). The exploits could read sensitive data and run malicious code on the host server. As far as anyone is aware, disaster was averted: cybersecurity researchers found the hack and reported it to the PHP Foundation, and a patch was released before bad actors got the exploit.

The story begins with an old bug. PHP, a language created in 1994 and largely used by legacy sites, had an out-of-memory error: the memory allocated to a piece of data was too small to hold it. Normally that kind of error just crashes the program, which is unpleasant but not inherently dangerous, so the bug sat unaddressed. It had been reported to the PHP Foundation as far back as 2024. Suman Jana, an associate professor of computer science at Columbia University, says there are always bug reports waiting that are just crashes, and most people do not take them very seriously.

Earlier this year, the cybersecurity firm Calif offered to independently audit PHP, sponsored by OpenAI. Within two weeks, a Calif researcher, aided by AI tools, found a way to use the out-of-memory bug to run arbitrary code on the host server, which would let an attacker install malware or read critical data. A minor bug had become a critical vulnerability, and Calif alerted the PHP Foundation to start on a patch immediately.

Jana explains why this was hard. Exploiting the bug means working out how to jump to a specific point in memory for a particular program on the server, and exactly which bits to overwrite in what order to take control. In his words, it is not rocket science, just a lot of very specific, painful reasoning, and AI has done a very good job at it. He is careful about the limits: the Calif researchers, OpenAI and Wiz (a cybersecurity company that confirmed and expanded the vulnerabilities) all had deep knowledge of both cybersecurity and PHP. AI cannot do it all by itself, he says, but it is improving, so the top 0.1 percent of experts can get much more done, and those just below can now go there without understanding all the details.

Fixing is slower than finding. After the exploits were disclosed, a team of four engineers at the PHP Foundation spent two months developing a patch. Jana calls this a fundamental asymmetry: a fixer has to be sure every part of the attack is closed and that no existing functionality breaks. The article adds that this strains defenders, especially in open-source projects like PHP that are widely used but lack clear revenue streams, a long-standing problem that AI hacking tools make more pressing.

The article points to two ways forward. One is to give defenders more money and access to frontier AI security models; Jana says frontier labs are donating some of their token budgets to look into such bugs and that this should happen more, through concerted effort or donations. The other is formal verification. Jana is optimistic that tools to automate patching are advancing quickly, including a new release from Anthropic on 22 October. In his description, an LLM generates the patch, an LLM generates a proof that the patch is correct, and only the proof checker is not an LLM, because LLMs hallucinate and something formal has to check the proof. The author hopes this combination will make patching nearly as automatable as finding vulnerabilities.

Matthew Green, an associate professor of computer science at Johns Hopkins University Information Security Institute, is less optimistic. He says nobody will fix the problem until something really bad happens, that PHP2Shell was not bad enough, and that this will maybe come sometime in early 2027, when something bad that normal people are upset by will make people suddenly fund everything. Meanwhile, his advice is to install security updates right away. Matt Suiche, AI security research lead at the cybersecurity startup Tolmo, frames the whole episode as legacy software written by humans over the last 40 years being exposed, with the technical debt now due. Jana's closing view: this will not be the last one, and the question is who finds it first, hopefully white-hat hackers, as here.

Key facts

PHP2Shell, disclosed in late October, put sites running PHP, including WordPress and Drupal sites, at risk of data theft and arbitrary code execution on the host server.
The root was an out-of-memory bug reported to the PHP Foundation as far back as 2024; it was treated as a harmless crash until a Calif researcher, aided by AI tools, found within two weeks how to run arbitrary code through it.
A team of four engineers spent two months building the patch, and as far as anyone is aware it shipped before bad actors got the exploit.
Columbia's Suman Jana says AI is good at the tedious reasoning exploitation needs, but not on its own: the researchers involved had deep knowledge of security and PHP.
Johns Hopkins' Matthew Green predicts, with a 'maybe', that something really bad will happen in early 2027 before people fund fixes; Jana is more hopeful about AI-driven formal verification for patching.

Why it matters

The article treats PHP2Shell as a possible canary in the coal mine for the age of AI. A bug that looked like an ordinary crash, left alone since at least 2024, became a critical code-execution hole once a researcher with AI tools worked on it. Matt Suiche's reading is that decades of human-written legacy software are now being exposed and the technical debt is due. The harder problem is the asymmetry Jana describes: finding bugs is getting cheaper, while fixing them still took four engineers two months.

Who it affects

Anyone running sites on PHP, which the article says includes WordPress and Drupal sites (among others) and names NASA, Wikipedia and the White House as examples at risk. It also lands on open-source maintainers, such as the PHP Foundation, who are widely relied on but lack clear revenue streams and now face a faster flow of AI-assisted findings. Security researchers and the frontier AI labs that sponsor and fund audits are part of the story too.

How to use it

The article offers a few concrete takeaways. Green's advice is to install security updates the moment they appear, rather than waiting a week. For defenders, Jana argues for more money and access to frontier security models, including more donated token budgets from AI labs through concerted effort or donations. He also points to formal verification, where an LLM writes a patch and a proof of correctness and a non-LLM proof checker verifies it, with a new Anthropic release on 22 October as an example of progress.

How solid is it

This is a feature by IEEE Spectrum associate editor Dina Genkina built on interviews with three named experts: Suiche (Tolmo), Jana (Columbia) and Green (Johns Hopkins). The core facts are stated plainly: the 2024 report, the Calif audit, the two-week exploit discovery and the two-month patch. The claim that no bad actors got the exploit is hedged in the article itself with 'as far as anyone is aware'. The article names no CVE or version numbers, and the sites it lists are described as 'at risk', not as confirmed breached.

Risks and caveats

Jana stresses that AI cannot do this alone; the Calif, OpenAI and Wiz researchers were deeply expert in security and PHP. Formal verification is promising but, as the author puts it, only a hope that patching might become nearly as automatable as finding bugs, and LLMs hallucinate, which is why a formal proof checker is needed. Green's early 2027 prediction is a 'maybe', and his point is that funding will arrive only after real harm. Jana expects more such cases and says the open question is who finds them first.

“One of the things we’re witnessing now is that all the legacy software that was written by humans over the last 40 years is being exposed”

— Matt Suiche, AI security research lead at the cybersecurity startup Tolmo