In 2024, while fixing an unrelated bug in the codebase, a PHP core developer noticed an odd out-of-memory issue. It looked worrying, but nobody could definitively prove it was dangerous in practice, and the engineering team could not agree on an appropriate patch. The issue was left alone.
Two years later, artificial intelligence helped two separate research teams prove that the flaw was catastrophic.
The result was PHP2Shell—two critical zero-day vulnerabilities that triggered an emergency release cycle and sent government IT defenses scrambling across the globe. This guide examines how that discovery unfolded, how researchers leveraged AI models to audit decades-old C code, and what this milestone reveals about the future of automated vulnerability discovery.
The Quick Answer
In short: AI did not replace human security researchers. Instead, modern models functioned as tireless research assistants—reading massive volumes of legacy C source code, identifying obscure allocation patterns, rapidly generating test hypotheses, and adapting proof-of-concept exploits across PHP release versions. Human researchers still chose the audit targets, evaluated real-world exploitability, verified impact in isolated labs, and coordinated disclosure with maintainers.
For deep technical breakdowns of the specific CVEs and immediate server mitigation steps, read our complete explainer on PHP2Shell.
Why Old Bugs Stay Hidden for Decades
The PHP2Shell vulnerabilities reportedly sat unaddressed in core interpreter code for over ten years. Several structural factors explain why severe flaws remain invisible in mature open-source software:
- They Look Unexploitable: A memory leak or out-of-bounds read often appears harmless or too fragile to convert into a working remote code execution (RCE) payload, causing triage teams to deprioritize it.
- Proving Exploitability Demands Enormous Effort: Establishing that a subtle memory corruption flaw is genuinely exploitable requires weeks of manual fuzzing, heap grooming, and payload crafting across different compiler builds and architectures.
- Codebases Are Sprawling and Highly Configurable: PHP runs across thousands of combinations of web servers (Apache, Nginx, LiteSpeed), SAPIs (FPM, CGI, mod_php), and runtime extensions, multiplying the test matrix exponentially.
- Maintainers Face Extreme Resource Limits: The global web depends on PHP, yet the PHP Foundation operates with a modest core team of approximately a dozen full-time and part-time developers managing millions of lines of C code.
- Fix Disagreements Stall Progress: When a proposed refactor carries a risk of breaking backwards compatibility or degrading performance, developer teams often stall until concrete proof of exploitation is established.
A Timeline of the PHP2Shell Discovery
| When | What Happened (As Reported) |
|---|---|
| 2024 | A routine security audit leads a PHP core developer to document an unusual out-of-memory condition. Without proof of exploitability, the issue remains unresolved. |
| Late July – August 2026 | At the PHP Foundation’s formal request, security researchers at Calif employ OpenAI’s GPT-5.6 Sol model to audit the PHP core codebase under the Patch the Planet program. A Calif researcher discovers and confirms a critical heap flaw. |
| August 2026 | Wiz Research independently uncovers related vulnerabilities utilizing Google DeepMind’s Gemini 4 Argon, GPT-5.6 Sol, and proprietary tooling (Wiz Atlas), submitting coordinated disclosures directly to PHP maintainers. |
| October 20, 2026 | The PHP team prepares an emergency security release schedule; technical indicators and exploit details leak prematurely onto public channels. |
| October 21, 2026 | Official PHP security releases (8.1.32, 8.2.25, 8.3.13) go live. Threat actors simultaneously launch automated scan sweeps searching for unpatched endpoints. |
Note: Discovery timelines and model architectures reflect published post-mortems from the involved research firms; dates may vary slightly across international time zones.
What AI Did, and What People Did
Understanding how AI tools fit into modern offensive and defensive engineering clarifies why neither AI nor human analysts could have completed this discovery in isolation.
| Research Stage | What the AI Models Performed | What Human Researchers Still Did |
|---|---|---|
| 1. Reading Code | Summarized hundreds of thousands of lines of C code, tracking pointer arithmetic and memory allocations across multiple modules. | Selected high-risk subsystems (file parsing, multipart data, SAPI boundaries) and judged which anomalies warranted scrutiny. |
| 2. Pattern Recognition | Scanned the wider codebase to detect structural patterns identical or related to a known historical bug. | Extracted the abstract architectural failure pattern from a verified bug to guide the search prompts. |
| 3. Forming Hypotheses | Brainstormed hypothetical input payloads and execution paths that could force an allocation buffer overflow. | Evaluated computer science plausibility, discarding hallucinations and impossible boundary conditions. |
| 4. Exploit Prototyping | Drafted Python scripts, socket generators, and adapted proof-of-concept payloads to match varying heap memory layouts. | Configured sandboxed virtual machines, executed tests in isolated labs, and analyzed GDB debugger core dumps. |
| 5. Impact Validation | Assisted in explaining unpredictable crash states and memory offset shifts between x86_64 and ARM64 builds. | Proved reliable, repeatable arbitrary code execution without relying on unstable edge cases. |
| 6. Coordinated Reporting | Drafted structured vulnerability summaries, reproduction steps, and suggested patch diffs. | Privately communicated with PHP Foundation core maintainers, verified patch effectiveness, and agreed on disclosure dates. |
Wiz Research reported that AI dramatically accelerated their ability to grasp memory corruption mechanics and tailor functional demonstrations across diverse PHP minor versions. Calif noted that identifying one subtle flaw pattern enabled them to prompt AI models across the remaining codebase to uncover sister bugs. These reflections represent the teams’ documented findings rather than third-party benchmark evaluations.
How Professional Researchers Validate a Bug
Spotting a suspicious line of C code in an IDE is merely step one. Ethical vulnerability research requires rigorous methodology to prevent accidental disruption and avoid wasting maintainer attention:
- Define Scope and Obtain Authorization: Conduct research exclusively on local source builds, open bug bounty programs, or with explicit maintainer permission. Never test against third-party production infrastructure.
- Formulate a Precise Failure Hypothesis: Document the exact theoretical condition—for example, an integer overflow leading to an insufficient
malloc()buffer—and predict expected register behavior. - Search for Sibling Patterns: Flaws rarely appear in isolation. If an input parser mishandles multipart headers in one module, check adjacent request handlers for identical assumptions.
- Construct Isolated Lab Environments: Test strictly inside air-gapped containers or virtual machines. Never connect testing scripts to live corporate or public networks.
- Ensure Deterministic Reproduction: A vulnerability report is only actionable if maintainers can reliably reproduce it with standard debugging tools (AddressSanitizer, Valgrind, GDB).
- Assess Real-World Attack Surface: Determine whether the bug triggers under default production configurations (e.g., standard PHP-FPM behind Nginx) or requires exotic, non-default runtime directives.
- Follow Coordinated Disclosure Standards: Submit technical findings through encrypted security reporting channels. Allow maintainers reasonable time (commonly 90 days) to construct and distribute patches.
- Collaborate on Patch Verification: Test upstream fix candidates against your proof-of-concept suite to verify that the patch fully resolves the root cause without introducing secondary regressions.
Where AI Models Still Fall Short
While generative models have rewritten the speed of vulnerability analysis, their limitations require constant human oversight:
- Plausible Hallucinations: AI models frequently explain non-existent security risks with unwavering confidence, misinterpreting benign memory protections as exploitable flaws.
- Noise and False Positives: Automated scans often flag theoretical buffer overflows that are rendered completely unreachable by upstream sanitization filters.
- No Concept of Real-World Context: Models do not understand operational safety, liability, or the delicate release coordination required by global open-source projects.
- Maintainer Triage Fatigue: The surge of unverified, AI-generated security tickets has inundated maintainers with low-quality submissions, threatening maintainer burnout across the open-source ecosystem.
The Human Rule of Security Research
Treat AI like an exceptionally fast junior research assistant. It excels at summarizing, pattern matching, and brainstorming, but a senior human engineer must rigorously verify every hypothesis and test result before any finding is disclosed or operationalized.
A Double-Edged Sword: Defenders vs. Attackers
The speed improvements unlocked by AI tools benefit defenders and threat actors in equal measure, intensifying the race between coordinated patching and active exploitation:
| Dimension | Security Defenders | Malicious Threat Actors |
|---|---|---|
| Application of AI | Audit large open-source codebases to discover and patch flaws before public disclosure. | Analyze security advisory diffs and leaked technical details to rapidly assemble weaponized exploits. |
| Strategic Advantage | Coordinated disclosure provides a head start to write fixes and notify enterprise distribution maintainers. | Early exploit leaks and unpatched enterprise delays collapse the window before servers update. |
| Action Mandate | Automate patch pipelines and provide zero-day detection signatures immediately. | Launch automated internet-wide scan sweeps within hours of public vulnerability disclosure. |
OpenAI characterized the PHP2Shell timeline as an illustration of the “defender’s window”—demonstrating that defensive researchers equipped with advanced models found the weaknesses before rogue actors weaponized them. However, when technical exploit details leaked prior to official packaging, threat actors rapidly mobilized. In modern cybersecurity, that defensive window is measured in hours, not weeks.
Actionable Steps for Website and Server Owners
- Assume Legacy Code May Be Vulnerable: Software components that have functioned reliably for a decade are not immune to critical memory flaws. Legacy infrastructure requires continuous defensive auditing.
- Compress Your Patching Cycle: As AI reduces the time required for adversaries to reverse-engineer security patches into functional exploits, automated staging and deployment pipelines become essential.
- Maintain Supported Runtime Versions: Ensure all production servers run active PHP branches (PHP 8.2 or 8.3). End-of-life releases like PHP 7.4 and 8.0 will never receive upstream security backports.
- Build a Complete Software Inventory: Organizations cannot protect unmapped assets. Regularly audit all public-facing subdomains, third-party vendor applications, and containerized microservices.
- Support Upstream Open-Source Foundations: The global digital economy relies on volunteer and small-team maintainers. Sponsoring organizations like the PHP Foundation directly strengthens internet infrastructure defense.
Learning Vulnerability Research Responsibly
- Master System Fundamentals: Develop deep literacy in memory management, pointer arithmetic, network protocols, and operating system kernels before relying on AI tools.
- Practice in Sanctioned Environments: Hone your testing skills using legal CTF (Capture the Flag) competitions, Hack The Box, VulnHub, and locally hosted vulnerable virtual machines.
- Study Coordinated Disclosure Policies: Read project-specific security disclosure guidelines (e.g.,
SECURITY.mdrepositories) and adhere to ISO/IEC 29147 responsible disclosure frameworks. - Never Test Without Written Consent: Probing third-party servers without authorization is illegal under computer misuse legislation worldwide, regardless of whether you intend to report the flaw.
AI Vulnerability Research Essentials
Clear answers on how AI models audit source code, identify zero-days, and assist defensive security teams.
Was PHP2Shell found by AI?
Researchers used advanced AI models to help find and validate the flaws. Two independent teams, Calif and Wiz, reported using AI in their research workflows, while human engineers directed the audits, verified memory corruption, and reported the bugs responsibly to the PHP Foundation.
Which AI models were used to find PHP2Shell?
According to public post-mortems, Calif utilized OpenAI’s GPT-5.6 Sol model through the Patch the Planet program. Wiz Research reported leveraging Google DeepMind’s Gemini 4 Argon, GPT-5.6 Sol, and their proprietary security analysis platform Wiz Atlas.
How do researchers validate a vulnerability?
Researchers reproduce the flaw deterministically in an isolated, air-gapped lab environment, evaluate which runtime versions and server configurations are vulnerable, judge real-world impact, and communicate findings privately to software maintainers so a patch can be developed.
Can AI find zero-day vulnerabilities autonomously?
AI can significantly accelerate discovery by highlighting suspicious allocation patterns and suggesting exploit vectors, as demonstrated in this case. However, models cannot yet operate reliably without human guidance, as they produce numerous false positives that require expert technical validation.
What is coordinated vulnerability disclosure?
Coordinated disclosure is the established industry practice where researchers report a flaw privately to maintainers first, establishing an agreed embargo period during which developers write, test, and package fixes before technical details are made public.
Is AI vulnerability research dangerous?
It represents a dual-use capability. While defenders use AI to discover and patch legacy flaws, malicious actors can utilize the same models to reverse-engineer security advisories into functional exploits more rapidly. This makes responsible disclosure and rapid enterprise patching critical.
Will AI replace human security researchers?
Not based on current capabilities. AI drastically reduces the time spent on manual code review and test script boilerplate, but humans are indispensable for selecting high-risk targets, validating real-world exploitability, making ethical triage decisions, and coordinating defense.
