PHP2Shell update: new attack data, and AI tools on the patch list
Follow-up to Thursday Oct 22: AI found a giant hole in PHP, then attackers got there firstRemember the PHP2Shell flaw from our very first edition? AI helped find it, and attackers moved fast. Now Wiz, the security firm that found it with OpenAI, published a report on exploitation attempts so far and how quickly people patch. It got 189 points on Hacker News.
A second guide, from Cloudsleuth, puts PHP2Shell next to flaws in LiteLLM and GitLab, and helps teams find what they actually run. LiteLLM is a popular tool that connects apps to many AI models, so AI plumbing is now on the patch list too. The AI Safety Newsletter from the Center for AI Safety adds to the mood, with a headline on fears of a 'Hackpocalypse'.
The story is not over. If you run a website or an AI gateway, the job is simple: find, patch, check.
A flaw found with AI is now a real-world attack story, and the tools we use to run AI are part of the target. Speed matters: the gap between disclosure and attack keeps getting shorter.
