# AI Kickstarted A PHP Vulnerability Crisis. Can It Fix It? > Source: > Published: 2026-10-30 15:42:28+00:00 # AI Kickstarted A PHP Vulnerability Crisis. Can It Fix It? ## The critical flaws affect widely used PHP systems, while security experts warn that patching alone may not reveal whether attackers already gained access. Last week, researchers at Google-owned Wiz, and Calif, an [AI firm](https://www.ibtimes.com/topic/ai), discovered significant [major vulnerabilities in PHP](https://www.cnbc.com/2026/10/23/php-vulnerabilities-ai-cybersecurity.html) with the help of models from OpenAI and [Google](https://www.ibtimes.com/topic/google). The warnings about the vulnerabilities quickly spread online. Widely known as PHP2Shell, they enable attackers to take over targeted websites. According to some [estimates](https://w3techs.com/technologies/details/pl-php), PHP runs across 70% of the web. As of this week, [CISA](https://techcrunch.com/2026/10/27/us-government-says-hackers-are-now-exploiting-critical-php-web-bugs/) has confirmed that hackers are now actively exploiting a pair of critical security vulnerabilities in PHP and has ordered federal agencies within the U.S. government to fix their systems within the next three days. As organizations look to shut down affected services, the incident demonstrates how ill-prepared modern organizations are for an uptick in [offensive AI threats](https://www.ibtimes.com/vast-majority-cyber-attacks-now-involve-ai-report-shows-3808570). "For years, the technical difficulty of exploring certain software vulnerabilities offered organizations a safety net. AI is now showing that even the most complex vulnerabilities may not remain difficult to exploit for long," Arvind Nithrakashyap, cofounder and CTO at Rubrik told International Business Times. "Patching quickly remains critical as the window to respond shrinks, but what patching doesn't tell you is whether attackers have already gotten in. With PHP2Shell, exploitation attempts were observed four days before patches were released, giving attackers an opportunity to establish access that could survive updates." Nithrakashyap went on to warn that organizations need to know exactly where they are exposed, including which systems and data could be at risk and whether attackers may have already gained access. He added that the possibility of compromise before a patch is deployed makes [breach preparation](https://www.ibtimes.com/anthropic-openai-breaches-show-enterprises-must-assume-breach-mindset-cybersecurity-going-forward-3807710) as important as prevention, as organizations can no longer rely on prevention alone. One of the issues with these vulnerabilities, which Cisco highlights, is that PHP 8.1 and older are end of life, whereas PHP 8.2 security support ends December 31 2026, with an estimated [50% of PHP systems not receiving a patch](https://blog.talosintelligence.com/two-critical-rces-in-php-core/). "The most dangerous assumption in the PHP2Shell incident is that the clock starts ticking when a vulnerability becomes public. Amazon recorded an exploitation attempt four days before the patch was released. Technical complexity can no longer be relied on to keep longstanding weaknesses out of an attacker's reach," Jay Bavisi, founder and group president of EC-Council told International Business Times via email. For Bavisi, it is a sign that patch management and incident response can no longer operate separately, with a need for teams to review historical activity for signs of exploitation. Roman Sannikov, global research coordinator iCOUNTER also noted the window between disclosure and exploitation is closing. "Attackers don't need a public proof of concept to start working. They [scan the internet for PHP servers](https://www.ibtimes.com/ai-software-supply-chain-becoming-more-dangerous-traditional-one-3808933) now and build their target lists, so when technical details land, they are ready to exploit on day one," Sannikov said. Sannikov said defenders should treat today's patches as urgent and start with internet-facing systems, including the older PHP 4,5,7,8.0 and 8.1 sites that tend to be forgotten. In case, the high rate of PHP servers that are no longer reported, indicates many organizations are going to need to update their systems. From this perspective, AI may help defenders discover vulnerabilities faster, but it doesn't address [systems that have been abandoned by the vendor](https://www.ibtimes.com/most-tech-leaders-have-canceled-an-ai-project-over-legacy-system-limits-research-shows-3808137), while attackers still have ample opportunity to surface potential exploits. © Copyright IBTimes 2026. All rights reserved.