I recently suggested that every company needs an AI Apocalypse Playbook. This past summer, security researchers used AI to turn weaknesses in PHP into working exploits. PHP is used by 69.3 percent of websites whose server-side language is identifiable. The PHP2Shell research offers a preview of an AI apocalypse: attackers running code on affected web servers without a password. The number of servers still exposed is unknown.
Patches for the two vulnerabilities were released October 21. Ask your security team or hosting provider to confirm your PHP installations are patched. If you need the details, start here.
The most interesting part of this story is that developers identified early signs of the out-of-memory root cause in 2024. The PHP Foundation says an exploit was theorized, with no concrete vector found. Competing fixes were attempted, stalled, and restarted amid compatibility tradeoffs, difficulty reaching consensus, and limited resources.
In August, expert researchers demonstrated code execution. Wiz says AI helped one researcher complete in a week work it estimates would previously have required a world-class team months. These were controlled security tests.
AI is seriously compressing the time and expertise required to turn obscure or difficult vulnerabilities into working attacks. Security decisions that were based on an attack being too expensive or technically demanding deserve another look. You really don’t want to be on the business end of a vibe-coded cyberattack.
Every company needs a Claw strategy. Do you have one?
Author’s note: This is not a sponsored post. I am the author of this article and it expresses my own opinions. I am not, nor is my company, receiving compensation for it. This work was created with the assistance of various generative AI models.
About Shelly Palmer
Shelly Palmer is the Professor of Advanced Media in Residence at Syracuse University’s S.I. Newhouse School of Public Communications and CEO of The Palmer Group, a consulting practice that helps Fortune 500 companies with AI strategy, implementation and governance, as well as technology, media and marketing. Named one of LinkedIn’s Top Voices in Technology, he is a bestselling author, covers tech and business for Fox 5’s Good Day New York, is a regular commentator on CNN, and writes the popular daily business blog Think About This. Follow @shellypalmer or visit shellypalmer.com.