Welcome to Kernel panic, a weekly newsletter written by Lily Hay Newman and Matt Burgess about the new world of digital privacy and security. To receive this newsletter in your inbox every week, sign up here.
As security teams and web administrators scrambled this week to patch newly public PHP bugs, criminal hackers quickly attempted to exploit the flaws in the wild. According to Cloudflare’s analysis, millions of exploitation attempts occurred within hours of the vulnerabilities being published, which is not surprising given the wide access to AI tools that can make it easier for attackers to quickly exploit the flaws.
So far, the nightmare scenario of takeovers and massive violations by victims has not come true. The PHP Foundation says it has not seen any successful exploitation of the bugs, collectively dubbed PHP2Shell, and many potential exploits circulating publicly appear ineffective. Perhaps AI’s most interesting role in this week’s chaos, however, is how advanced models have helped researchers uncover practical exploitations of vulnerabilities that have been known, at least in part, for years. In other words, AI helped transform a historic vulnerability into a current crisis.
So, are we all about to be hit by a wave of critical vulnerabilities that have persisted for decades?
Researchers at security firm Calif were the first to identify PHP2Shell vulnerabilities and create exploits in early August, partly using cutting-edge AI tools as part of OpenAI’s Patch the Planet program, but also using expert human knowledge of PHP, its dynamics and weaknesses. Some of the underlying issues were identified in 2024 but were deemed too complex to exploit at the time. Following Calif’s discovery, researchers from OpenAI and Google-owned security firm Wiz independently discovered PHP2Shell vulnerabilities using AI tools.
“The PHP team knew about this vulnerability for years, but because it couldn’t be exploited by an attacker (at least, not a human one), it wasn’t fixed,” says Sagi Tzadik, security researcher at Wiz.
No software is perfect. There are inevitably vulnerabilities in even the most critical foundational digital tools, but the growing capabilities of AI models have accelerated the analysis and potentially exploitation of vulnerabilities. This puts even more pressure on under-resourced IT teams, developers, and administrators who need to keep up. Microsoft’s security updates included a record 1,453 security vulnerabilities this month alone. Meanwhile, Bank of America recently hired 1,000 consultants to fix flaws discovered by Anthropic’s Mythos. Security researchers emphasize, however, that AI ultimately does not do anything new, but rather amplifies the existing dynamic of vulnerability discovery and coordinated disclosure.
Gn bussni
