{"slug": "ai-kickstarted-a-php-vulnerability-crisis-can-it-fix-it", "title": "AI Kickstarted A PHP Vulnerability Crisis. Can It Fix It?", "summary": "Researchers at Google-owned Wiz and an AI firm called Calif used models from OpenAI and Google to discover critical PHP vulnerabilities, dubbed PHP2Shell, that let attackers take over targeted websites running on PHP, which W3Techs estimates powers 70% of the web. CISA has confirmed hackers are actively exploiting a pair of the critical PHP flaws and ordered U.S. federal agencies to patch their systems within three days, while Cisco's Talos warns that PHP 8.1 and older are end of life, PHP 8.2 security support ends December 31 2026, and an estimated 50% of PHP systems will not receive a patch. Rubrik CTO Arvind Nithrakashyap said exploitation attempts were observed four days before patches were released, adding that \"what patching doesn't tell you is whether attackers have already gotten in.", "body_md": "# AI Kickstarted A PHP Vulnerability Crisis. Can It Fix It?\n\n## The critical flaws affect widely used PHP systems, while security experts warn that patching alone may not reveal whether attackers already gained access.\n\nLast week, researchers at Google-owned Wiz, and Calif, an [AI firm](https://www.ibtimes.com/topic/ai), discovered significant [major vulnerabilities in PHP](https://www.cnbc.com/2026/10/23/php-vulnerabilities-ai-cybersecurity.html) with the help of models from OpenAI and [Google](https://www.ibtimes.com/topic/google). The warnings about the vulnerabilities quickly spread online. Widely known as PHP2Shell, they enable attackers to take over targeted websites.\n\nAccording to some [estimates](https://w3techs.com/technologies/details/pl-php), PHP runs across 70% of the web. As of this week, [CISA](https://techcrunch.com/2026/10/27/us-government-says-hackers-are-now-exploiting-critical-php-web-bugs/) has confirmed that hackers are now actively exploiting a pair of critical security vulnerabilities in PHP and has ordered federal agencies within the U.S. government to fix their systems within the next three days.\n\nAs organizations look to shut down affected services, the incident demonstrates how ill-prepared modern organizations are for an uptick in [offensive AI threats](https://www.ibtimes.com/vast-majority-cyber-attacks-now-involve-ai-report-shows-3808570).\n\n\"For years, the technical difficulty of exploring certain software vulnerabilities offered organizations a safety net. AI is now showing that even the most complex vulnerabilities may not remain difficult to exploit for long,\" Arvind Nithrakashyap, cofounder and CTO at Rubrik told International Business Times.\n\n\"Patching quickly remains critical as the window to respond shrinks, but what patching doesn't tell you is whether attackers have already gotten in. With PHP2Shell, exploitation attempts were observed four days before patches were released, giving attackers an opportunity to establish access that could survive updates.\"\n\nNithrakashyap went on to warn that organizations need to know exactly where they are exposed, including which systems and data could be at risk and whether attackers may have already gained access. He added that the possibility of compromise before a patch is deployed makes [breach preparation](https://www.ibtimes.com/anthropic-openai-breaches-show-enterprises-must-assume-breach-mindset-cybersecurity-going-forward-3807710) as important as prevention, as organizations can no longer rely on prevention alone.\n\nOne of the issues with these vulnerabilities, which Cisco highlights, is that PHP 8.1 and older are end of life, whereas PHP 8.2 security support ends December 31 2026, with an estimated [50% of PHP systems not receiving a patch](https://blog.talosintelligence.com/two-critical-rces-in-php-core/).\n\n\"The most dangerous assumption in the PHP2Shell incident is that the clock starts ticking when a vulnerability becomes public. Amazon recorded an exploitation attempt four days before the patch was released. Technical complexity can no longer be relied on to keep longstanding weaknesses out of an attacker's reach,\" Jay Bavisi, founder and group president of EC-Council told International Business Times via email. For Bavisi, it is a sign that patch management and incident response can no longer operate separately, with a need for teams to review historical activity for signs of exploitation.\n\nRoman Sannikov, global research coordinator iCOUNTER also noted the window between disclosure and exploitation is closing. \"Attackers don't need a public proof of concept to start working. They [scan the internet for PHP servers](https://www.ibtimes.com/ai-software-supply-chain-becoming-more-dangerous-traditional-one-3808933) now and build their target lists, so when technical details land, they are ready to exploit on day one,\" Sannikov said.\n\nSannikov said defenders should treat today's patches as urgent and start with internet-facing systems, including the older PHP 4,5,7,8.0 and 8.1 sites that tend to be forgotten.\n\nIn case, the high rate of PHP servers that are no longer reported, indicates many organizations are going to need to update their systems. From this perspective, AI may help defenders discover vulnerabilities faster, but it doesn't address [systems that have been abandoned by the vendor](https://www.ibtimes.com/most-tech-leaders-have-canceled-an-ai-project-over-legacy-system-limits-research-shows-3808137), while attackers still have ample opportunity to surface potential exploits.\n\n© Copyright IBTimes 2026. All rights reserved.", "url": "https://wpnews.pro/news/ai-kickstarted-a-php-vulnerability-crisis-can-it-fix-it", "canonical_source": "https://www.ibtimes.com/php2shell-vulnerabilities-actively-exploited-cisa-warns-3809201", "published_at": "2026-10-30 15:42:28+00:00", "updated_at": "2026-10-30 15:48:43.433346+00:00", "lang": "en", "topics": ["ai-safety", "ai-policy", "artificial-intelligence"], "entities": ["Wiz", "Calif", "OpenAI", "Google", "PHP", "CISA", "Cisco", "Rubrik"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/ai-kickstarted-a-php-vulnerability-crisis-can-it-fix-it", "markdown": "https://wpnews.pro/news/ai-kickstarted-a-php-vulnerability-crisis-can-it-fix-it.md", "text": "https://wpnews.pro/news/ai-kickstarted-a-php-vulnerability-crisis-can-it-fix-it.txt", "jsonld": "https://wpnews.pro/news/ai-kickstarted-a-php-vulnerability-crisis-can-it-fix-it.jsonld"}}