AI Turned a 22-Year-Old PHP Vulnerability Into an Emergency
A PHP vulnerability that security experts have worried about since 2004 became a real emergency this month, and AI is the reason. Researchers found the flaw was possible to exploit in days, not decades. It’s the same weakness behind the PHP2Shell patch we covered in our earlier report, and its history explains why it matters.
A warning that went nowhere for two decades
In July 2004, researcher Stefan Esser warned that a flaw in PHP, the language behind about 70% of websites, could let attackers read passwords, steal databases or take over sites. Little happened. According to CNN’s analysis, a related problem found in 2020 got only a partial fix, and a similar one found in 2024 was left alone.
Too tedious to be worth attacking
The flaw survived because exploiting it was miserable work. A human attacker would have to force a server to run out of memory at a precise moment to get around PHP’s safety limits. Fieldwork AI CEO Nick Rogers calls this “security by exhaustion”: a weakness stays safe because nobody has the patience to use it.
AI doesn’t get tired. Calif’s researchers began pointing an AI model at PHP on July 30 as part of OpenAI’s Patch the Planet program, expecting nothing serious. By August 1 they had a working attack method, then more soon after. Wiz found its own exploits later that month. Calif’s Ryan Austin noted the team used no special models, only tools available to the public.
How the attack worked
When a PHP server crashes from lack of memory, it can leave stale data behind, and attackers can use that leftover state to leak information or run code. The AI found two ways to trigger it: one abuses a mismatch in how PHP measures compressed and unpacked files, and the other uses deeply nested file folders to overwhelm PHP’s directory handling.
The patch doesn’t end the risk
CrowdStrike’s Adam Meyers warned that many old PHP versions are still running, and the update almost certainly didn’t fix every PHP problem. Cloudflare reported thousands of exploit attempts in the hours before the announcement, after details leaked early. Moving away from PHP isn’t realistic for most organizations, since it means rebuilding whole applications.
If you run a PHP site, update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on your branch, as Help Net Security lists, or ask your host to confirm it.
A wake-up call for defenders
Carnegie Mellon professor Vyas Sekar says this is likely the first of many, because more flaws like it are waiting to be found. The old comfort that a flaw is too hard to bother with no longer holds, so even a few days of delay on patching now carries real risk.
