AI Tool Uncovers PHP Memory Flaw Allowing Remote Code Execution on 70 Percent of Sites

The vulnerability, named PHP2Shell, had existed for years but required AI assistance to turn into practical exploits. Austin demonstrated compromises in seconds on some systems and hours on others. Coordinated response involved PHP developers, Google Wiz, and OpenAI teams who modified nearly 200 files and added over 10,000 lines of code before an October 22 target date.

Leak of the patch details on Hacker News forced an accelerated public release on Wednesday. Government and commercial operators began taking systems offline while early attack attempts appeared. The episode shows how AI compresses both discovery and weaponization timelines, altering the prior assumption that complex flaws would remain dormant.

State and commercial actors now face identical tooling advantages. Defenders gained early notice through controlled research channels, yet the same models lower barriers for any operator seeking to automate exploit generation. Documented PHP Foundation statements confirm this ranks as the language’s most severe issue since 2014 Heartbleed.

Next phase centers on patch adoption rates and whether unpatched instances become concentrated targets. Primary records from the coordinated group show secrecy was chosen specifically to deny attackers parallel AI-driven reverse engineering time.