TL;DR
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Researchers using AI tools turned a PHP memory bug reported in 2024 into a vulnerability capable of running code on affected servers. A patch was released after responsible disclosure, but the case highlights how AI can help security specialists find exploitable flaws in legacy software faster than maintainers can safely fix them.
Security researchers using AI tools turned a PHP memory-management bug reported in 2024 into PHP2Shell, a vulnerability that could let an attacker run code on an affected server. The PHP Foundation was alerted and a patch was released before researchers knew of any malicious use, but the case shows how AI can help specialists uncover risks in decades-old software that had been treated as a lower-priority bug.
The flaw began as an out-of-memory error, a condition in which a program does not allocate enough memory for data. Such errors commonly cause crashes, and the bug remained unaddressed after being reported to the PHP Foundation in 2024. During an independent audit of PHP sponsored by OpenAI, researchers at cybersecurity firm Calif used AI tools to work out how the error could be turned into a route to arbitrary code execution.
Calif reported its findings to the PHP Foundation, which began work on a patch. The report says a team of four engineers spent two months preparing the fix. Cybersecurity company Wiz also confirmed and expanded the vulnerabilities. The original report said the flaw put a wide range of sites using PHP-based systems at risk, including sites associated with NASA, Wikipedia and the White House; it did not report that those organizations had been breached.
The researchers were not relying on AI alone. Columbia University computer science professor Suman Jana said the work depended on deep expertise in cybersecurity and PHP, while AI helped with the detailed reasoning needed to turn a crash bug into an exploit. The report said the patch was released before any bad actor was known to have obtained the exploit. It did not provide a count of affected sites or confirm whether every potentially affected installation had been updated.
AI Raises the Cost of Legacy Bugs
The case matters because it illustrates a shift in the time and expertise required to investigate old software. AI did not independently discover and exploit the PHP flaw, according to the researchers. Rather, it helped specialists work through technical details that had made the bug difficult to assess. That could allow a small number of experts to examine more code and could help less-specialized practitioners reach problems that once demanded deeper knowledge.
The same speed does not automatically extend to repairs. Maintainers have to close every route an exploit might use while preserving existing behavior, a more complicated task than demonstrating one way into a system. If AI-assisted discovery makes more dormant bugs actionable, open-source maintainers may face a larger queue of urgent fixes without a matching increase in funding or engineering capacity. The immediate lesson for site operators is practical: apply the relevant security updates promptly.
Products Worth Considering
Samsung 34-Inch Odyssey G5 Ultra-Wide Curved Gaming Monitor
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
LG UltraGear 32GX850A-B 32-inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From PHP Bug to PHP2Shell
PHP was created in 1994 and remains part of the technology behind many established websites and content-management systems. The underlying issue was reported to the PHP Foundation in 2024, but an error expected to cause a crash did not initially appear to present the same danger as a route to taking control of a server.
Earlier this year, Calif conducted an independent PHP audit sponsored by OpenAI. Within two weeks, its researcher used AI tools to identify a way to turn the memory error into code execution. The finding was disclosed to the PHP Foundation; Wiz later confirmed and expanded the vulnerabilities. The episode is part of a wider concern about how AI changes both security research and software maintenance, not evidence that AI by itself can find or fix every flaw.
“Now it is time for the technical debt to be paid off.”
— Matt Suiche, AI security research lead at Tolmo
Exposure and Patch Adoption Remain Unknown
The report does not establish how many servers were vulnerable, how many have installed the patch, or whether any attacker exploited PHP2Shell before disclosure. It says researchers were aware of no bad actors with the exploit, which is not the same as proving that no exploitation occurred. The full scope across affected PHP versions and installations is also not detailed in the source material.
It remains uncertain how often AI-assisted research will convert previously known bugs into practical exploits, and whether AI tools will make secure patching faster at a comparable pace. Formal verification could help check some fixes, but it does not by itself solve the staffing and funding problems facing widely used open-source projects.
Updates and Verification Are the Next Steps
PHP users and organizations running affected software should consult the PHP Foundation’s security guidance and apply the relevant update. The source report does not specify a version number or an update deadline, so administrators should check official release information for their installations rather than assume every deployment is covered in the same way.
Security researchers and maintainers will continue to assess the vulnerability and the patch. Jana has pointed to formal verification as one possible way to make checking fixes more automatable, while stressing that a proof still needs a trustworthy checker. The broader question is whether developers, companies and AI providers will supply enough resources for maintainers to respond as quickly as new vulnerabilities are found.
Key Questions
What is PHP2Shell?
PHP2Shell is the name used for a PHP vulnerability that researchers developed from a memory error into a way to run code on an affected server.
Did AI discover the vulnerability on its own?
No. The report says AI tools assisted researchers at Calif, who had specialized knowledge of PHP and cybersecurity. Jana explicitly said AI could not do the work entirely by itself.
Were major websites hacked through PHP2Shell?
The report said sites associated with NASA, Wikipedia and the White House were among those potentially at risk because of the software involved. It did not report that those sites were breached, and researchers knew of no bad actors with the exploit before the patch was released.
What should website operators do?
Check official PHP Foundation security information and update affected software promptly. The report advises users not to delay security updates, but does not name a specific PHP version or give a complete list of affected installations.
Source: spectrum.ieee.org
