Calif, a US-based cybersecurity company, has discovered a serious security vulnerability in PHP, a widely used programming language that underpins websites and online applications. PHP is estimated to be used by approximately 70% of websites and web applications worldwide, although its adoption has been declining.

The vulnerability, dubbed PHP2Shell, could allow hackers to execute unauthorized code on unpatched servers, potentially gaining control of systems, stealing data or launching further attacks. The actual level of exposure depends on each organization's server configuration and PHP deployment.

The discovery also highlights how artificial intelligence is transforming cybersecurity research. AI can help specialists uncover software flaws that have remained undetected for years, but it can also enable attackers to develop exploitation tools much faster.

First to uncover the vulnerability

According to Calif, its researchers identified the problem within days using advanced AI models developed by OpenAI. GPT-5.6 Sol was used during the initial source-code analysis, while another OpenAI model that had not been publicly released assisted researchers in investigating potential exploitation methods.

Ryan Austin, a researcher at Calif, identified the flaws while examining PHP's source code in August. Nguyen Thai Duong, the company's CEO, subsequently contacted the PHP development team to warn of the severity of the problem.

Speaking to The Wall Street Journal (WSJ), Duong said the most troubling aspect was not simply AI's ability to discover vulnerabilities, but the speed at which the technology could turn a software weakness into a practical attack tool.

He revealed that the vulnerability had existed in PHP's source code for many years. A security researcher had even raised concerns about the underlying issues decades earlier, but they were considered extremely difficult to exploit and were largely forgotten.

With the advancement of AI models, however, certain exploitation techniques can now be carried out in seconds against relatively simple systems. More complex environments may require hours, depending on technical conditions.

Calif is among a small group of companies and research organizations granted early access to advanced AI models before their broader public release. It uses these systems to test their ability to identify and exploit security weaknesses, helping developers address vulnerabilities before malicious actors can take advantage of them.

Before PHP2Shell, Calif investigated a vulnerability in WeChat, China's popular messaging platform. According to the company, the flaw could potentially be exploited to compromise user accounts.

Its researchers also used an early version of the Mythos AI model to bypass certain security protections in Apple's macOS operating system.

Those earlier findings had a relatively limited practical impact. PHP2Shell, however, is considered significantly more concerning because of PHP's widespread use and the possibility that attackers could reproduce exploitation techniques across numerous servers.

A race against hackers

After receiving the warning, PHP's development team worked with security researchers, software distributors and cybersecurity companies to develop a patch.

Google-owned cybersecurity company Wiz independently identified and reported related vulnerabilities, while OpenAI's research team contributed additional analysis.

The remediation effort was extensive. According to WSJ, nearly 200 source-code files required modifications, and developers wrote more than 10,000 additional lines of code while addressing the vulnerabilities.

The PHP team initially planned to release the patch on October 22. However, after information about the update leaked onto the Hacker News forum, developers accelerated the timetable and released the fix on October 21.

The earlier release gave organizations an opportunity to secure their systems sooner, but it also intensified the race against potential attackers.

Once a security patch becomes publicly available, hackers can examine changes to the source code to determine how vulnerabilities might be exploited in systems that have not yet been updated.

AI makes that race increasingly concerning. Tasks that once required experienced security specialists and considerable time can now be automated to some extent, allowing both defenders and attackers to shorten their research and development cycles.

Ami Luttwak, co-founder of Wiz, described PHP2Shell as one of the most serious vulnerabilities discovered with AI assistance.

Bruce Dang, a researcher at Calif, warned that the consequences of the vulnerability could persist for some time.

Risks for businesses and government agencies

PHP is an open-source technology that has existed for decades and was originally associated with the name Personal Home Page.

The programming language plays a major role in widely used content management systems and website platforms, including WordPress and Drupal.

Because PHP is deployed on such a vast scale, addressing the vulnerability involves far more than simply publishing a software patch.

Businesses must identify which systems are running affected versions, verify compatibility with updated software, deploy the necessary fixes and assess whether their infrastructure may already have been compromised.

Organizations with limited cybersecurity resources or slow software-update procedures may face greater risks.

In some circumstances, security authorities have recommended temporarily disconnecting vulnerable systems from the Internet when patches cannot be applied promptly.

Several European government websites have also temporarily suspended operations amid concerns about potential attacks.

OpenAI confirmed that Calif used its models during the research process and said Wiz had independently discovered and reported related vulnerabilities.

According to OpenAI, the incident demonstrates that AI can identify security weaknesses with potentially Internet-wide consequences. At the same time, those capabilities could allow malicious actors to develop attack tools and exploitation techniques at unprecedented speed.

For Calif, the case illustrates AI's increasingly important role in cybersecurity.

The technology can help uncover vulnerabilities that human researchers have overlooked for years. Ultimately, however, effective protection still depends on how quickly organizations update their software and how successfully they prevent attacks that emerge after vulnerabilities become public.

Du Lam