After AI helped uncover decades-old critical vulnerabilities in the world’s most popular server-side programming language PHP, security experts have started to uncover functional exploits in the wild.

Last week, several Australian government and global organisations took down their websites for maintenance to combat a pair of security vulnerabilities affecting PHP, which is the scripting language used in an estimated 70 per cent of websites and web applications.

Dubbed PHP2Shell, the flaws could reportedly enable hackers to read sensitive data such as passwords or API keys from an unpatched web server’s process memory, or in certain circumstances, execute remote code.

Though patches were released to address these vulnerabilities, exploitation in the wild was confirmed Tuesday after the United States Cybersecurity and Infrastructure Security Agency (CISA) added both vulnerabilities to its list of Known Exploited Vulnerabilities.

While CISA did not list any specific victims, Information Age understands the vulnerabilities have been replicated in live ‘honeypot’ environments, which are designed to intentionally attract malicious hacks for testing, threat-scanning and broader defence purposes.

One such attack uncovered from Adel Karimi, detection and response lead at AI web search firm Perplexity, reportedly saw such honeypots hit by multiple IP addresses across numerous regions.

Karimi was also able to record evidence of remote code execution via PHP2Shell, including some unsuccessful ‘wget’ commands typically used to download files from a server.

“This is confirmed [remote code execution] with usable memory disclosure, not just a crash followed by a suspicious process,” wrote Karimi.

Jamieson O’Reilly, founder of information security company Dvuln, told Information Age that although the honeypots were deliberately set up to create favourable circumstances for attackers, they demonstrated the PHP2Shell attack chain can work in practice.

He also observed a lack of known security breaches stemming from PHP2Shell but emphasised that this did not mean breaches were not occurring.

“Confirmed compromises usually surface weeks or months later, once incident response wraps up,” said O’Reilly.

“The attacks are real, and code execution in the wild has now been confirmed under favourable conditions.”

Notably, attempted attacks were also detected via honeypots at tech giant Amazon some four days before the vulnerabilities were disclosed, implying hackers may have been aware of the exploits before security patches existed.

“After disclosure, attempts went from thousands to tens of thousands within minutes and into the millions shortly after,” said O’Reilly.

“The attack volume has been enormous.”

Not just websites

O’Reilly said the PHP scripting language is used for more than public-facing websites.

“It runs admin panels, internal tools, APIs, hosting control panels, intranets, and the web interfaces on a lot of network appliances and embedded devices,” he said.

“Any of those exposed to a network is in scope, and because this is remote code execution, a compromised web server is rarely the end goal.

“Attackers use it as a foothold to steal data, stage ransomware, or recruit the machine into a botnet.

And though many organisations applied security patches to resolve the flaws last week – an endeavour which resulted in droves of website outages for emergency maintenance – countless environments remain unpatched.

Indeed, Google-owned cybersecurity company VirusTotal counted more than five million IP addresses running PHP online — many of which O’Reilly stressed were unmaintained or running ‘end-of-life’ PHP that may not receive appropriate security patches.

“Those will be targets for a long time,” O’Reilly said.

“PHP maintainers have been clear that configuration changes only partly protect you and patching is the only complete fix.

“This is problematic because we've seen many organisations find themselves in a position where they cannot patch to the most updated version due to a long history of entangled dependencies on older versions.”

AI for good, AI for bad

According to security firms Calif and the Alphabet-owned Wiz, the vulnerabilities were uncovered with assistance from numerous generative AI systems, including some from Google and OpenAI.

O’Reilly said although AI was a boon to security researchers in the case of PHP2Shell, it could just as easily help criminals find their own malicious exploits.

“There’s an established market for undisclosed vulnerabilities,” he said.

“That’s why organisations can’t rely on patching speed alone – you have to assume something will eventually get through and be ready to spot it.”

Indeed, the Australian Signals Directorate (ASD) on Monday warned Australians to prepare for more online service outages in the battle against AI-enabled attacks.

“We need AI tools to help automate our defences to stay ahead of AI-enabled attackers,” said ASD director general Abigail Bradshaw.

While unveiling the agency’s latest annual cyber threat report, Bradshaw added that frontier AI was “creating enormous opportunities” but also enabling malicious cyber actors to “identify vulnerabilities and conduct attacks faster, at greater scale, and with greater precision than ever before”.