Two PHP vulnerabilities dubbed “php2shell,” an error at an Indian certificate authority, and a China-state aligned hacking campaign all hit last week, causing chaos for defenders around the globe. In episode four of IST’s “Vulns + AI = Oh My!” IST experts and guests unpacked the mayhem, from vulnerability discovery and multi-party disclosure to policy concerns, election-season risks, and more.
The panelists included Casey Ellis (Bugcrowd; disclose.io), Cynthia Kaiser (Halycon; former FBI), Katie Moussouris (Luta Security), Art Manion (Tharros), and Nick Leiserson (IST), with moderator Jen Ellis (IST; NextJen Security).
PHP in a (2)Shell
PHP (originally “Personal Home Page” and now “PHP: Hypertext Preprocessor”) is a programming language that underpins roughly 70% of websites, including those built on WordPress, Joomla, and Drupal. In 2024, a PHP core developer found the first signs of the underlying bug during a PHP security audit. It was not recognized as an exploitable vulnerability for two years, until Calif, OpenAI, and Wiz discovered in August that it could enable remote code execution.
These findings kicked off a coordinated, multi-party disclosure effort over the past couple of months to build a patch and get it to defenders before threat actors could exploit the software. Last Tuesday, leaks pointing to the PHP vulnerabilities and their proof of concepts circulated on social media. On Wednesday, Chainguard broke the multi-party disclosure embargo and released a patch to its users, making the wide-scale vulnerability public. Later that day, developers who maintain the PHP code released their patch and “strongly encouraged” all PHP users to update their software immediately.
Humans in the loop and ‘slopdemic’
Although the bug was identified years ago, OpenAI, Wiz, and Calif used frontier AI models with minimal guardrails to discover and exploit the vulnerability. As Katie Moussori highlighted, these frontier models were paired with “human experts and tuned harnesses,” and show the need for a “skilled operator in the driver’s seat” who can point the AI at the right target and pull it back when it goes down the wrong path. She also argued that for defenders without “super special access,” guardrails are “absolutely interfering,” taking away some of the tools defenders need most to find and fix vulnerabilities.
Casey Ellis pushed back against the idea that we’re in a “vulnpocalypse,” since we aren’t seeing industrialized exploitation. Instead, he called it a “slopdemic.” According to Ellis, AI has made it easier to find real vulnerabilities, but it’s also made it easier to hallucinate them and generate a convincing story that a bug might exist. For defenders, this means that even an increase in discovered, exploitable vulnerabilities is overpowered in the noise of slop reports.
Art Manion added that there’s a lot of AI “slop to wade through,” including contrived exploits where it’s unclear whether something is actually exploitable or just a bug. To him, that means “spend[ing] the human hours on something and figur[ing] out what the AIs have said.”
Coordinating disclosure
Moussouris highlighted that before a patch is released, there’s coordination between the parties involved (Moussouris and Manion are the co-editors of the ISO standard on coordinated vulnerability disclosure). She emphasized the need to define clear, transparent triggers for breaking an embargo, because the decision is a “little bit subjective.” “You’re trying to do this balancing act of protecting yourself, your users, other people, and honoring the agreements that you’ve made in this embargo, so that you get invited to the next embargo and don’t get left out,” she said.
Manion called multi-party vulnerability disclosure an unsolved, “wicked problem” but described the PHP coordination as a “net win” because defenders who could “asymmetrically provide defense” got advance notice that they could act on, which he called a “key global risk-reducing thing.”
Looking ahead to future “internet trash fires,” Ellis said organizations will need to filter out noise and identify which elements of a vulnerability actually matter to them, so they can “act rationally” in how they defend themselves.
Policy, prepositioning, and the polls
CISA’s initial guidance urged organizations to take PHP systems offline if they couldn’t patch. Cynthia Kaiser called it “hair on fire language for the government to put it out,” noting that CISA has rarely used language this strong. She went on to ponder what else might come along that warrants a “patching is an emergency” type of response from the government.
Separately, Nick Leiserson argued that two problems sit underneath the broader conversation around PHP2Shell. First, urgent calls from multiple governments to patch or take systems offline expose that policymakers “still don’t have an intuitive grasp of how much software runs their lives.” He argued that part of the policy response, including political attention from officials like the Japanese Prime Minister, stems from surprise that a software library they’ve never heard of could be instrumental in powering seven out of ten websites. Second, he noted that while the underlying flaw behind the vulnerability was not known to developers, they had, by their own admission, not prioritized fixing it. He argued that this gap reveals a misaligned incentive that policymakers should care about: software developers face internal counterpressure that can delay addressing potential vulnerabilities. In an age of AI-powered exploit development, even seconds can be damaging.
A potential consequence of bugs like PHP2Shell being deployed so widely is that patching may take a long time, Leiserson explained. He outlined how actors could use vulnerabilities to gain quiet access they can take advantage of later, rather than causing damage at scale now. That’s “scary” from a national security policy perspective, he said.
With midterms coming up, Kaiser argued that “there’s probably no better time than the weeks before an election” for any cyber election officials to find something they can fix and act on it right away. Moussouris also pointed to the rippled effects of PHP2Shell on local party organizations and candidate websites, which often share ballot and polling information. These sites are “almost all on WordPress,” she noted, and “there’s nobody really available from a volunteer perspective to help them all out.”
But wait, there’s more!
While PHP2Shell may have stolen the show, it certainly wasn’t the only act setting off cyber alarms around the world last week. To hear the panelists’ takes on the eMudhra certificate authority breach and the China-state aligned hacking campaign Storm-0940, watch the full webinar!
