PHP2Shell: AI uncovers critical RCE in PHP

Wiz Research reported the discovery of several critical vulnerabilities in PHP, a widely-used scripting language that runs 70% of websites globally. These flaws, present in every PHP version released in the past decade, could lead to unauthorized remote code execution and permit attackers to steal sensitive data or manipulate websites.

While human researchers struggled to exploit these issues, frontier AI models significantly facilitated their identification and resolution. The PHP team, Calif, and OpenAI played crucial roles in disclosing and patching these vulnerabilities, which are now categorized under two CVEs with a severity score of up to CVSS 9.2. By combining these vulnerabilities into a single exploit script called php2shell, researchers were able to demonstrate that the issue could be leveraged to execute code remotely on various websites, including WordPress, Drupal, and Joomla.