AI nearly identified PHP2Shell vulnerability before its official disclosure

PHP2Shell, a remote code execution vulnerability in PHP, was recently disclosed after being identified through AI-assisted methods. The vulnerability, which was rated CVSS 9.2, emerged alongside a three-minute demo that showed its potential to target platforms like WordPress, Drupal, and MediaWiki. This incident underscores the increasing reliance on AI tools in uncovering critical security flaws.

The vulnerability was first leaked in a video marked with a Calif watermark, which demonstrated how PHP2Shell could be used to exploit various PHP-based applications. The video appeared shortly before PHP's security team announced a patch release to address two critical vulnerabilities, both rated CVSS 9.2, scheduled for the next day at 14:00 UTC.

Testing with DeepSeek V4.1 Flash, a model running on a pair of DGX Sparks, revealed the AI's ability to detect potential threats. However, the system encountered a memory limit issue, which proved to be a critical factor in its analysis. This limitation highlights the challenges AI still faces in fully automating vulnerability detection processes.

The implications of AI's near-detection of PHP2Shell raise questions about the balance between security and computational resource constraints. As AI tools become more integrated into security workflows, the cost of deploying such systems, the potential for vendor lock-in, and the governance of AI-driven security measures will become increasingly significant. These factors will shape how organizations adopt and manage AI in their security strategies.

The situation remains dynamic, with ongoing developments in both AI capabilities and the speed at which vulnerabilities are discovered and patched. The interplay between AI and traditional security practices will likely continue to evolve, influencing how vulnerabilities are identified and mitigated in the future.