An interview with Ondřej Surý, a volunteer who maintains and helps automate PHP patches, about his role in fixing two critical PHP security vulnerabilities

Exploiting software vulnerabilities with AI is now significantly easier, potentially leading to widespread security issues.

Two critical security vulnerabilities in PHP, dubbed PHP2Shell, were recently discovered using AI tools by researchers from Wiz, Calif., and OpenAI. The discovery and subsequent disclosure led to a surge of attempted exploits. Cloudflare reported millions of attempts to exploit the vulnerabilities within hours of their public announcement. This event, along with other recent discoveries in systems like eMudhra, Node.js, and Gitlab, has fueled concerns among cybersecurity experts about AI's accelerating impact on hacking. In response, organizations worldwide, including the NSA and the Prime Minister of Japan, urged immediate patching of websites and services. Some services, like 4chan and Wikimedia, were temporarily taken offline for updates. Despite the high number of exploit attempts, widespread exploitation has not yet been observed, with some experts noting that current AI-generated exploits are not as sophisticated as previously seen 'stop the world' vulnerabilities.

The rapid discovery and potential exploitation of PHP2Shell highlight a paradigm shift in cybersecurity, driven by AI's enhanced capabilities in identifying software flaws. This acceleration shortens the window for traditional bug-fixing workflows, forcing a re-evaluation of how vulnerabilities are disclosed and patched. The ease with which AI can now probe the internet for weaknesses means that previously unnoticed or difficult-to-find bugs are being uncovered at an unprecedented rate, posing a significant challenge to maintaining internet security.

This development signals a market shift where offensive capabilities are becoming more accessible, potentially democratizing hacking to a degree. Companies and developers must now contend with AI-powered attackers who can operate at a scale and speed that human attackers alone could not achieve. The pressure is on to not only find and fix vulnerabilities faster but also to fundamentally rethink software architecture and security practices to be more resilient against AI-driven threats.