These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history. The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.
You know it’s bad when a cybersecurity incident makes it to the BBC homepage! And boy, am I happy my blog is just a statically generated website made of simple HTML files.
Like many others, I started out on the web with PHP and MySQL, and eventually moved to WordPress. Knowing how many people around me still rely on PHP for production systems and websites, I’d say the current panic is very justified. Let’s hope they can patch these vulnerabilities before they cause too much real-life damage.
We need to be better prepared and brace for what’s coming. The next months and years will be rough, and good old traditional, human-based cybersecurity won’t be enough if we want to stand a chance.
Source: PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet