Skip to main content
UK AI Council
Philip Blake, CEO of the UK AI Council, speaking at the launch event

Practice

PHP2Shell shows AI has changed what counts as an exploitable flaw

Human researchers saw this PHP flaw in 2024 and could not prove it was exploitable. Researchers using widely available AI models proved it in a fortnight. A flaw that was safe only because it was hard to exploit is no longer safe.

Giles Hamlin
3 min read
23 October 2026
PHP2Shell: AI has changed what counts as exploitable

The two PHP flaws fixed on 21 October 2026 were not new and indeed, work on a fix stalled and restarted repeatedly for around two years until August 2026. That month, researchers working with AI models found the flaw within days and demonstrated a working attack within two weeks, significantly reducing the cost of exploiting it.

The cloud security firm Wiz found the flaws independently using Wiz Atlas, Gemini 4 Argon (Google DeepMind) and GPT-5.6 Sol (OpenAI). Wiz says one researcher did in a week what a specialist team would once have needed months to do. In addition, the security firm Calif says it used no special tooling and only models that were available to everyone.

These AI tools afforded the opportunity for the National Cyber Security Centre (NCSC) to be briefed before disclosure, with a fix ready for every supported PHP version. Despite this, attackers moved fast and Cloudflare recorded thousands of exploitation attempts in the ten hours before the release and millions within a day.

It should be noted that despite these efforts, as of 22 October, the UK Government said it knew of no confirmed compromise of public sector systems whilst the US Cybersecurity and Infrastructure Security Agency (CISA) and the German and Dutch cyber agencies said they had seen no successful attack.

The lesson is plain. A flaw that was safe only because it was hard to exploit is no longer safe, and every organisation runs software with flaws of that kind. UKAIC asks:

  1. Organisations to plan on the basis that exploitation attempts now begin within hours of a disclosure, and to keep an inventory of the software they run so a component like PHP can be found and updated within a day.
  2. The NCSC and the Department for Science, Innovation and Technology (DSIT) to state in guidance that the time between disclosure and exploitation is now measured in hours, and to say whether the 14-day patching window in Cyber Essentials still fits.
Human researchers found this bug in 2024 and could not prove it was exploitable, yet Researchers with AI proved it in two weeks. The same models then helped get a fix out before the details were public. Any organisation that is not using AI to defend itself is now defending against people who are using it to attack.
- Giles Hamlin, Chief Technology Officer, UK AI Council

Sources: