PHP flaws draw millions of attack attempts, with no successful exploitation seen

Newly public PHP vulnerabilities drew millions of exploitation attempts within hours of publication, Cloudflare analysis cited by WIRED found. The PHP Foundation says it has seen no successful exploitation of the flaws, collectively called PHP2Shell, and many circulating potential exploits appear ineffective. Researchers at Calif developed practical exploits in early August using frontier AI tools alongside specialist knowledge of PHP. Some underlying issues had been identified in 2024 but were considered too complex to exploit. OpenAI and Wiz researchers subsequently found PHP2Shell flaws independently using AI tools. The findings show how AI assistance can make longstanding weaknesses practically exploitable, while researchers emphasize that sophisticated work still requires human expertise.