PHP2Shell: attackers already use AI. We use it to protect our clients

This week, two critical vulnerabilities were disclosed in PHP, the language that powers about 70% of websites. Known as PHP2Shell, they let an attacker take control of a server without a username or password. The flaws had been in the code for more than a decade and were considered too difficult to exploit, until AI-assisted researchers showed that it was possible.

Our view

This case shows that AI cuts both ways. The same models that help find and fix flaws also help attackers search for vulnerable systems and prepare attacks faster. Coalition detected the first exploitation attempts about two and a half hours after the fix was released. And according to Qualys, 71% of the PHP installations it analyzed run unsupported versions, most of which will never receive a fix.

For a company, the risk lies in the time between the release of a patch and its installation. If attackers use AI to shorten that time, defenders have to use it too. The most exposed systems are usually the forgotten ones: an old website, a form, or an internal panel that is still online.

Our commitment

At Youtouch, we use AI to defend our clients. When a critical alert like this one is published, our team identifies which systems use the affected technology and which version they run, applies the fix, and checks that services keep working. It then reviews logs, processes, connections, and files for signs of an attack. AI lets us review more information in less time, and a specialist validates every decision. The client gets a clear answer about what was fixed, what was verified, and what is still pending. With this process, we can act on the same day the alert comes out.

Recommendations

• Keep an inventory of the sites and systems that run PHP, with their version and owner.
• Upgrade to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12, depending on the branch, and confirm on the server that the new version is active.
• Plan the migration of everything that runs PHP 8.1 or earlier. Those versions are no longer supported.
• Use AI for defense too: review logs and detect unusual behavior. Upgrading fixes the flaw, but it does not show whether someone got in before.
• If you cannot upgrade right away, reduce exposure with web application firewall (WAF) rules and take offline anything that does not need to be public.

More findings like this will come, and attackers will keep using AI to exploit them. Companies that know their systems and use AI to defend themselves will be able to respond in hours. If you need support reviewing yours, let's talk.

Sources: Wiz, Qualys, Coalition, and the PHP Foundation.

Write to us to schedule an in-person or online meeting.

💬 WhatsApp: https://wa.me/56976313053