PHP security issues bring new vulnerabilities to light with the help of artificial intelligence
Web admins deployed patches for the newly public PHP2Shell vulnerabilities after automated exploitation attempts surged within hours. Cloudflare recorded millions of probes, though the PHP Foundation reported no success
Web admins deployed patches for the newly public PHP2Shell vulnerabilities after automated exploitation attempts surged within hours.
Cloudflare recorded millions of probes, though the PHP Foundation reported no successful breaches.
How the problems were revealed
In early August, researchers from Calif.com discovered the vulnerabilities, using in part advanced artificial intelligence tools. Shortly after, researchers from OpenAI and Wiz independently discovered the same problems using similar tools.
Some of the underlying issues had been identified as far back as 2024, but were deemed too complex to exploit at the time. As Wiz's Sagi Zadik noted, the vulnerability had been known for years, but could not be exploited by a human attacker.
The immediate reaction and attacks
Once the issues became public knowledge, millions of attack attempts were recorded within hours, according to Cloudflare data. Technicians and website administrators rushed to install the relevant updates.
READ ALSO
Serious security flaw in Google code affects Node.js and other applications
However, the team behind PHP's development reported that there has been no successful exploitation of the vulnerabilities, while many of the attempts circulating appear to be ineffective.
What experts say about artificial intelligence
While AI can speed up the search for old problems, experts say no model can simply find all bugs with simple commands. Ryan Austin of Calif. said the process requires more, while Nils Provos said he is not particularly concerned about the possibility of attacks from historical bugs becoming more widespread.
In other industry developments, Microsoft included a record 1.453 fixes in its monthly updates in October, while Bank of America hired a thousand consultants to address issues identified by an artificial intelligence tool. Jake Williams of Hunter Strategy noted that while old issues will resurface, few technologies share the unique characteristics of PHP that expose it so readily to the internet.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Originally published by Dev.to WebDev. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.