As security teams and web administrators scrambled this week to patch newly public PHP bugs, criminal hackers swiftly attempted to exploit the flaws in the wild. Millions of exploitation attempts hit within hours of the vulnerabilities being published, according to analysis from **Cloudflare**—unsurprising given broad access to AI tools that can make it easier for attackers to quickly exploit flaws. So far, the nightmare scenario of mass victim takeovers and breaches hasn’t come to pass. The **PHP Foundation** states it hasn’t seen any successful exploitation of the bugs, collectively dubbed **PHP2Shell**, and many publicly circulating potential exploits appear to be ineffective. ### AI: From Obscurity to Crisis Perhaps the most interesting role of AI amid the chaos this week is how advanced models helped researchers uncover practical exploitations for the vulnerabilities, which were known about, at least in part, for years. In other words, AI helped turn a historic vulnerability into a current crisis. Researchers at security company **Calif** were the first to identify the **PHP2Shell** vulnerabilities and create exploits in early August. This was partially achieved using frontier AI tools as part of **OpenAI**’s **Patch the Planet** program, but also leveraged expert human knowledge of PHP, its dynamics, and its weaknesses. Some of the underlying issues were identified in 2024 but were deemed too complex to exploit at the time. Following Calif’s discovery, researchers at **OpenAI** and the **Google**-owned security firm **Wiz** independently discovered **PHP2Shell** flaws using AI tools. “The vulnerability had been known to the PHP team for years, but because it could not be leveraged by an attacker—at least, not a human one—it was not addressed,” says **Sagi Tzadik**, a security researcher at **Wiz**. ### The Magnifying Glass Effect No software is perfect. There are inevitably flaws in even the most critical, foundational digital tools. However, the expanding capabilities of AI models have made it faster to analyze and potentially exploit vulnerabilities. This puts even more pressure on under-resourced IT teams, developers, and admins to keep up. **Microsoft**’s security updates included a record 1,453 security vulnerabilities this month alone. Meanwhile, **Bank of America** recently hired 1,000 consultants to fix flaws discovered by **Anthropic**’s **Mythos**. Security researchers emphasize, though, that AI is ultimately not doing anything new, but rather magnifying existing dynamics of vulnerability discovery and coordinated disclosure. “We'll definitely see more of these long-life bugs that are in every version of the software for the last decade or whatever,” says **Jake Williams**, vice president of research and development at **Hunter Strategy** and a former **NSA** hacker. “But I think there’s only so much of this low-hanging fruit. There isn’t much else that has the specific reach of PHP. It’s a pretty wild attack surface—most other tools aren’t exposed to the internet by design.” ### Human Expertise Remains Key Researchers note, too, that even with frontier models, most examples of sophisticated AI-aided hacking still involve human expertise. As **Ryan Austin**, the Calif researcher who first discovered the PHP flaws, wrote this week, “No model is simply capable of unearthing ‘all bugs’ with simple prompts. At least for now.” In short, security engineer and researcher **Niels Provos** says, everyone can dial back their freak-outs, at least a bit. “To be honest, I am not really worried,” he says, about AI finding an overwhelming number of historic bugs that are newly exploitable—or new vulnerabilities that couldn’t have been practically exploited without AI. “People have now been looking with AI for over a year, and it required a highly skilled team to find this one. I guess we will see whether I am completely wrong, but I doubt it.”