PHP2Shell Vulnerabilities Exposed, AI Drives Rapid Patch Rollout

Two critical PHP vulnerabilities—dubbed PHP2Shell—were publicly disclosed last week after an AI‑driven code‑analysis tool identified flaws that allow attackers to execute arbitrary code on web servers. The bugs, targeting the PHP language that powers roughly 70 % of the world’s websites, enable remote attackers to run shell commands by manipulating crafted HTTP requests. The discovery was accelerated by machine‑learning models that scanned millions of open‑source repositories, demonstrating how AI can hunt for syntactic patterns that correlate with known exploit techniques. Immediate advisories from major hosting providers and vulnerability databases urge all PHP‑based organizations to upgrade to the latest patch (PHP 8.3.1) and to audit configurations for CGI and FastCGI interfaces. As these flaws are already being actively exploited in the wild, senior counsel should coordinate with IT security teams to conduct an inventory, validate patch status, and implement monitoring for anomalous PHP traffic. This episode underscores the growing intersection of AI and security testing, and signals that future critical vulnerabilities may be detected—and leaked—at an unprecedented pace.