PHP2Shell Shows Why The Time To Patch Is Shrinking
Jordan Craig
Principal Consultant
AI helped researchers develop and adapt PHP exploits in hours. With attack attempts now being reported, businesses face an urgent update.
PHP has released an emergency update for two critical flaws that could let an attacker run commands on a web server without logging in. Cloudflare has already reported attack attempts, and businesses running affected websites and applications are being urged to patch.
PHP2Shell is the name researchers at Wiz gave to an exploit script they demonstrated against deployments of WordPress, Drupal and Joomla. The flaws are in PHP itself, the software those applications depend on, and can affect other applications too. The research also showed how passwords and other sensitive information could be exposed from a server’s memory.
The discovery involved OpenAI’s Patch the Planet initiative, which supported research firm Calif’s audit of PHP. Calif identified a critical flaw using GPT-5.6 Sol, while Wiz independently discovered and reported both vulnerabilities. PHP’s maintainers then worked with researchers and infrastructure providers to prepare fixes and protections ahead of publication.
The PHP Foundation says signs of one of the underlying problems had been recognised in 2024, but no concrete way to exploit it had been found at the time. Wiz now says AI helped its researchers develop and adapt working exploits across different applications in hours, using models including Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol.
The release itself became a scramble after the vulnerability identifiers leaked on 20 October. PHP issued an advance warning without technical details and moved the planned update from 22 October to 21 October. Later that evening, Calif mistakenly published a video showing its existing exploit working against several targets. Although the video was removed, copies circulated. The PHP Foundation says it helped accelerate the development of further proof-of-concept code.
Code claiming to exploit the flaws is now publicly available, although Tenable says it has not verified that those releases work. Separately, Cloudflare has observed attackers changing their requests to try to bypass its protections. For businesses with exposed services, that is a reason to make an immediate decision about patching.
Practical steps for businesses
Review your external attack surface. Use your external attack surface management (EASM) tools to identify websites and services you may have missed, including older systems and assets hosted by third parties.
Refresh asset and vulnerability data. Check that inventories and scans cover PHP wherever it is running, with current vulnerability checks. Track affected systems through to a verified fix.
Check what is publicly accessible. Confirm which applications are reachable from the internet, prioritise affected services and restrict public access where it isn’t needed.
Verify WAF protection. Confirm public web applications route through your web application firewall and that current protections are enabled. This can reduce exposure while PHP is patched; it does not replace the update.
Give the response clear ownership. Coordinate an emergency response across security, IT and hosting providers. Assign a lead and an owner for each affected service, with clear deadlines for patching and confirmation that the fixes are in place.
““We’re seeing AI help defenders find and fix weaknesses faster, while giving cyber criminals the means to exploit them more quickly. Businesses need to move at that same pace to protect themselves.””