❯ AI-assisted PHP2Shell discoveries trigger millions of exploitation attempts

A flaw beneath the applicationTwo PHP vulnerabilities disclosed by Calif, OpenAI, Wiz and Quarkslab are known as PHP2Shell. Cloudflare says PHP 5.4 and later are affected: crafted requests can cause outages, data exposure or remote code execution. The flaw is in the runtime, so updating a website plugin alone does not fix it.

Attempts accelerateCloudflare CEO Matthew Prince reported thousands of attempts in the ten hours before disclosure, tens of thousands within 45 minutes afterward, hundreds of thousands within two hours, and eventually millions. Axios confirmed that researchers used an OpenAI model in the discovery. Attempts are not a count of compromised sites.

Mitigation and repairCloudflare deployed default protections for free and paid customers using its web application firewall, combining request and response signals. Some institutions temporarily took websites offline pending repairs. Firewall protection reduces exposure, while updating the PHP runtime addresses the underlying problem.

A faster clock for old codeAI-assisted auditing can turn longstanding defects into demonstrable vulnerabilities. Once techniques become public, attackers can replicate them quickly; defenders must inventory servers, schedule upgrades and verify applications individually. Faster discovery therefore puts pressure on asset management, patch distribution and operational response to move faster as well.

▮ SIGNALFaster discovery and replication increase the value of rapid asset inventories, patch deployment and application checks.