AI-Found PHP2Shell Flaws, Hidden Over a Decade, Forced Emergency Patches on Government and Corporate Websites

Earlier this month, authorities around the world urged website administrators to run emergency updates. The PHP Foundation, a nonprofit that coordinates development of the PHP programming language, had flagged critical security flaws that could let hackers breach systems.

Some government and corporate websites briefly went offline to apply the patches. The vulnerabilities carry the nickname PHP2Shell.

Independent cybersecurity researchers found them using artificial intelligence. The flaws had sat in PHP's code for more than a decade. They went unnoticed because exploiting them was too complicated for humans to manage without advanced AI.

A language that runs most of the web

PHP dates to 1995, when Danish-Canadian programmer Rasmus Lerdorf wrote it to track visitors to his online resume. Developers around the world improved it, and it spread. Facebook and Wikipedia were built with it. PHP runs about 70 percent of the world's websites.

The PHP Foundation was launched in 2021. Like many foundations that maintain open-source software, it operates on a meagre budget.

PHP is not an outlier. The Firefox browser is open source. So are Perl, Python and JavaScript. Many servers run Apache HTTP Server, maintained by the Apache Software Foundation.

"The world today, including proprietary software vendors, relies on open source software for its digital infrastructure," said Amanda Brock, CEO of OpenUK, a nonprofit that supports open source.

Why maintainers expect more of this

Cybersecurity experts and the people who maintain critical software say PHP2Shell could be the first in a flood of AI-exposed flaws. Their concern is capacity. Much of the most important code is kept up by volunteers who lack the time and money to answer newly found threats quickly.

"There's been a lot of people in the AI safety community that said this is one of the first areas where we are going to see the harmful impact of AI," said Peter Slattery, a research scientist at MIT's FutureTech. He studies how security professionals are handling the technology and tracks real-world AI incidents.

The companies that depend on this code include Meta, Google, OpenAI and Anthropic. Their own AI tools are now turning up flaws in that infrastructure faster than groups like the PHP Foundation can handle with their current resources.

Maintainers argue that trillion-dollar corporations that build products on volunteer-built software should put significantly more money and labor into securing it. Finding a bug is the fast part. Verifying it, writing a fix and getting it deployed still takes people.

The AI stack has its own weak points

A separate line of research points at the machines that run AI models. The security firm Eclypsium, which partnered with Nvidia on the work, published a report on how attackers could tamper with a model by compromising the hardware and software underneath it.

A model's runtime state, the report says, is controlled by "a hierarchy of software, firmware, memory controllers, management processors, and I/O devices." Each layer is a possible entry point.

Eclypsium demonstrated a technique that changed a model's operating state after the usual integrity checks had run. The check was effectively fooled into reporting that everything was fine.

"The model file does not need to change," the researchers wrote. "The container, model hash, and signed artifacts on disk can remain valid while selected runtime weights are changed in memory."

The report says systems from Nvidia, AMD, Intel and Arm are all vulnerable to such techniques. The firm said chipmakers should follow Nvidia's lead and use data processing units to enforce security policy independently of the AI system, with adequate protection for the DPUs themselves.

For businesses, Eclypsium recommended keeping accurate inventories of every component in their AI systems. It also advised folding those components into vulnerability-handling processes and closely scrutinizing third-party software running on critical hardware.

"Trusted AI therefore requires the ability to see and verify those components rather than assuming the model boundary begins at the container," the researchers wrote.

What is unresolved

The PHP2Shell patches have gone out, and the affected sites that went dark have come back. The harder question is the one maintainers are raising: who pays for the next round of fixes. The PHP Foundation's budget is described only as meagre, and no one in the reporting has put a dollar figure on what keeping up with AI-speed discovery would cost.