AI Helps Researchers Find Practical Ways to Exploit PHP Security Flaws
October 29, 2026 · 2 min read
Also published in Svenska, Português (Brasil)
Cybersecurity teams and website administrators are rushing to update PHP following the publication of several security vulnerabilities.
Attackers began attempting to use these weaknesses to infiltrate internet connected systems within hours of the disclosure. A vulnerability known as PHP2Shell has gained attention because artificial intelligence helped researchers find practical methods to exploit it.
Cloudflare analysis detected millions of exploitation attempts in the hours after the vulnerability information was published. While attack attempts increased sharply, this has not yet resulted in mass hacking.
The PHP Foundation stated that it has not yet found any successful exploitations, and several public exploitation examples are considered ineffective.
Researchers from the security firm Calif identified PHP2Shell and developed an exploitation method in early August. They used AI models through the OpenAI Patch the Planet program, although the process still required human expertise to understand the code and ensure the weakness could be utilized.
Some of the underlying issues were identified in 2024 and had been known to the PHP team for years, but were previously considered too complex for direct exploitation. Researchers from OpenAI and the security firm Wiz also independently found related vulnerabilities.
AI is accelerating vulnerability analysis and increasing pressure on developers and administrators with limited resources. Microsoft security updates in October 2026 covered a record 1,453 vulnerabilities. Bank of America hired 1,000 consultants to fix weaknesses found by the Anthropic AI Mythos.
Despite these developments, AI has not fully changed basic cybersecurity principles. It speeds up the search and analysis of weaknesses, but complex research still requires human skill. Ryan Austin from Calif emphasized that AI models cannot find all bugs through simple commands, and security researcher Niels Provos warned against panic because PHP2Shell still requires highly skilled teams.