The AI Apocalypse Has A Working Prototype

I recently suggested that every company needs an AI Apocalypse Playbook. This past summer, security researchers used AI to turn weaknesses in PHP into working exploits. PHP is used by 69.3 percent of websites whose server-side language is identifiable. The PHP2Shell research offers a preview of an AI apocalypse: attackers running code on affected web servers without a password. The number of servers still exposed is unknown.

Patches for the two vulnerabilities were released October 21. Ask your security team or hosting provider to confirm your PHP installations are patched. If you need the details, start here.

The most interesting part of this story is that developers identified early signs of the out-of-memory root cause in 2024. The PHP Foundation says an exploit was theorized, with no concrete vector found. Competing fixes were attempted, stalled, and restarted amid compatibility tradeoffs, difficulty reaching consensus, and limited resources.

In August, expert researchers demonstrated code execution. Wiz says AI helped one researcher complete in a week work it estimates would previously have required a world-class team months. These were controlled security tests.

AI is seriously compressing the time and expertise required to turn obscure or difficult vulnerabilities into working attacks. Security decisions that were based on an attack being too expensive or technically demanding deserve another look. You really don’t want to be on the business end of a vibe-coded cyberattack.