PHP2Shell: AI Exploits for Long-Known Vulnerabilities
Andrew Ginter
VP Industrial Security, Waterfall Security
On October 21, the PHP project released emergency patches for two critical vulnerabilities in PHP, the software behind a large fraction of the world’s websites. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are collectively called PHP2Shell. Both are rated critical – successful exploitation can let an unauthenticated attacker execute arbitrary code on web servers. Wiz provides a technical analysis.
Cloudflare reports millions of attempts to exploit these vulnerabilities in the wild, but is unable to say how many of the exploits succeeded. Note: this does not mean there are millions of attackers in the wild – in theory all those attacks could have been launched by the same individual using automated tools.
Related PHP memory-management vulnerabilities were investigated as early as 2020 and again in 2024, but were not considered significant then. This was because of the amount of effort it would take to develop an exploit – “mind-numbing,” time-consuming, monotonous coding, involving an “exceptionally complex chain of steps, at the edge of what human researchers could practically achieve.” It turns out that today’s frontier AIs are really good at that kind of work.
What Can Frontier AI Really Do?
I had opportunity to discuss frontier AI attack capabilities with an expert who has been evaluating the attack capabilities of such AIs for the last 6 months.
The big takeaway from (what I recall of) her assessment: frontier models cannot reliably do any of the following: reverse engineer software, find zero-days, craft and chain together exploits, nor automate cyber attacks on their own, at least not for non-trivial tasks. For each of these tasks, if they are of any size or complexity, they need expert supervision. If you want an AI to do any of this in any sort of realistic, medium to high complexity environment, you have to be able to do the thing yourself. You have to catch and correct the AI when it starts to hallucinate. You have to inspire the AI with zero-day scenarios to investigate, attack scenarios to try out, and exploit designs to experiment with when the AI runs out of steam.
That’s good news, kind of – script kiddies with tokens in their pockets are not a credible threat for sophisticated, zero-day-based attacks. The bad news? The high end of the ransomware criminal economy and nation-state-grade attackers either already have experts who can do this, or have the money to buy the expertise. AI does not replace attack experts but makes those experts enormously more productive.
For a broader discussion of AI attack capabilities, including how attack paths change in the face of different defensive architectures, join my webinar on Oct 28th (or watch the recording).
The Defender's Advantage Is Disappearing
More fundamentally, the defender’s advantage is disappearing. Historically, many argued that defenders have an advantage in protecting operational technology (OT) / industrial control system (ICS) targets. Each of these targets is configured differently, and there is enormous variety in the nature and versions of software technologies deployed at these targets. OT is much less homogenous than IT.
And so, if an attacker, such as the Russian attack on Ukrainian power distribution utilities in 2015, wants to bring about a physical consequence, such as turning the lights off, they have a lot of learning to do. The assumption is that, like in Ukraine, attackers who want to bring about consequences need to dwell in the target network for significant amounts of time, figuring out how it works – it took the Russians up to months to do this in 2015. For all this time, defenders have an opportunity to detect the attack, and respond and recover, before damage is done.
In a future (not today) where we see fully automated AI-driven attacks moving at machine-speed, the time for that learning curve will reduce dramatically. When fully automated AI attack tools exist, even if experts are still needed for reverse engineering, finding zero-days and designing exploits, it is reasonable to expect an adversary to launch a thousand such tools into the cloud and say to them – take down this target “X”. Do anything it takes – anything at all. Do as much damage as you can. Yes, dozens of those AIs may make mistakes, but the attacker does not care.
When that time comes, will defenders be able to launch a thousand fully automated AI tools to defend themselves? Can they give those tools the instruction, “The bad guys are coming. Do anything it takes, anything at all, to keep them out, and if you find them in the network, kick them out.” Will we give that instruction for a safety-critical process? Or a critical infrastructure process? I don’t think so. Some of those thousands of AIs will make mistakes, and the worst mistakes shut down critical infrastructure, or damage the equipment so badly that we cannot start up again for months, or worse. For the foreseeable future, and perhaps forever, we need to supervise or severely constrain the behavior of AI agents on critical infrastructure networks. This will slow the response of the defenders and their AIs compared to the ability of fully autonomous AIs to attack without human supervision.
In an era of fully automated AI attacks, defenders will no longer enjoy weeks or months to detect, respond and recover. We still need detect / respond / recover capabilities, don’t get me wrong, but those capabilities will no longer confer the advantage to defenders that some claim they do today.
Engineer the Attack Paths Away
This is why I keep coming back to Cyber-Informed Engineering (CIE) and network engineering.
For important industrial operations, the question is not simply, “How quickly can we patch the next zero-day?” We need to prevent credible cyber attacks from causing unacceptable physical consequences, even when the attacker has a zero-day and an AI behind them.
I write regularly on CIE and network engineering topics, most recently about the new Offshore Norge 104 standard and the CISA / CCCS / AU NCSC / NZ NCSC – endorsed UK NCSC Secure connectivity principles for Operational Technology (OT).
Looking Forward
The immediate response to PHP2Shell is to find vulnerable installations and patch them. And of course, investigate to determine whether we have been compromised already, and if so, respond and recover. And if we cannot patch promptly, then restrict access and isolate vulnerable systems to the greatest extent practical.
Looking further out, AI-assisted vulnerability discovery and exploit development are no longer theoretical. They are demonstrated capabilities, at least in the hands of experts. Our most capable adversaries have access to such experts.
If any of our facilities have systems and defenses that, should they succumb to a zero-day attack, would lead to unacceptable physical consequences if compromised, we need to be looking hard at those attack paths right now. Apply CIE principles. Engineer away the attack paths that don’t need to exist. Apply electro-mechanical and other mitigations from the CIE Engineered Controls Database to eliminate unacceptable consequences to the greatest degree feasible.
We cannot wait for sophisticated, machine-speed AI-automated attacks to become commonplace. We need defenses in place sooner than that.
About the author
Andrew Ginter
VP Industrial Security, Waterfall Security
Andrew Ginter is the most widely-read author in the industrial security space, with over 23,000 copies of his three books in print. He is a trusted advisor to the world's most secure industrial enterprises, and contributes regularly to industrial cybersecurity standards and guidance.
Share
Trending posts
Stay up to date
Subscribe to our blog and receive insights straight to your inbox
