A vulnerability at web scale
The flaw, associated with the php2shell exploit, could let an attacker shut down a site, steal data or deceive its users. Details were kept private while a fix was prepared. The researchers reported the vulnerabilities to the organization overseeing PHP, where developing a patch took time: a rushed, broken fix could make things worse.
PHP dates to the mid-1990s and helped shape the early web. Its reach makes a severe vulnerability more consequential: the 9.2 score reflects not just the seriousness of the issue, but how widely the language is used.
Eliot says it is unclear why some attackers started exploiting the flaw before the patch announcement. They may have been tipped off, or found it themselves. The announced 24-hour wait may also have given attackers time to study the vulnerability before a fix became available.
The patch is only the start
For site owners, a day’s warning creates an awkward choice: keep a vulnerable site online or take it offline. Applying a patch also takes staff, time and coordination, and a botched installation could disrupt a site or leave it exposed.
Some governments and private organizations temporarily shut down individual public websites. That can protect systems, but it can also cut people off from essential services.
The patch is now available, but disclosure does not mean the risk has passed. Owners may not have seen the news, may assume the flaw does not affect them, or may wait after tuning out repeated security warnings. Deployment could take days or weeks; some sites may remain exposed much longer, or never be updated.
AI can help both sides
Attackers can use AI to help build an exploit, identify unpatched sites and avoid wasting effort on systems that are already protected. Eliot also describes AI as a way to help choose valuable targets, plan how to extract the most from an attack and hide activity from alarms.
AI developers try to make their systems refuse criminal requests, but those safeguards can sometimes be bypassed. Coordinated attackers can also use open models that are not subject to the same controls.
My concern is that the patch window is only one part of the exposure. The harder problem is getting fixes onto a large, dispersed population of websites before attackers find the systems that remain vulnerable. AI can speed up both discovery and abuse; the deciding factor may be whether defenders can turn a released patch into widespread adoption.
Daily AI news
Every day we pick what actually matters in AI and explain it plainly — no hype, no filler. Subscribe if you want to follow where the industry is going.
Only what matters — every day
Follow on X