AI Cuts Complex PHP Exploits From Expert Work to Hours

What happened

Why it matters

• ·Risk-scoring systems such as patch prioritization frameworks and residual risk acceptance decisions were built around the assumption that complex exploitation requires scarce human expertise. AI-assisted exploitation invalidates that assumption, making prior 'low urgency' risk acceptances potentially unsound and requiring a reassessment of open vulnerability backlogs.
• ·Any organization running PHP-based infrastructure, including WordPress, Drupal, or Joomla sites, faces a materially higher likelihood of compromise until patches are applied. Compliance programs that rely on time-based patch SLAs rather than real-world exploitability risk falling out of step with regulators and insurers. Both are beginning to expect organizations to track the actual threat environment.
• ·The research adds to a growing body of evidence, including the A $40K AI Run Cracked Chrome. Offensive AI Risk Is Now a Board Issue. finding, that AI-assisted offensive capability is accelerating faster than most enterprise security programs have updated their threat models. Governance teams that have not revisited how exploitability is assessed in their risk registers should treat this as a prompt to do so.

Governance controls affected

What to do now

• ☐Ask your IT or security team to confirm that all PHP installations in production, including those used by WordPress, Drupal, and Joomla, have been patched for the two CVEs identified in the Wiz PHP2Shell research, and get a written confirmation with a date.
• ☐Review your organization's vulnerability patch prioritization process and ask whether exploitability estimates account for AI-assisted attacks, not just traditional human-expertise thresholds. If they do not, flag this as a gap for your next risk committee meeting.
• ☐Pull a list of any open risk-acceptance decisions where a vulnerability was deprioritized because exploitation was deemed technically difficult. Review each one against the reality that AI now makes difficult exploitation achievable in hours.
• ☐Ask your third-party software and vendor management team whether PHP-based systems operated by vendors on your behalf, such as web hosting providers or managed content management platforms, are covered by their patch SLAs and whether those SLAs have been met for the PHP2Shell CVEs.
• ☐Check whether your adversarial testing or red-team program includes AI-assisted attack scenarios. If it does not, add this as a formal requirement in the next testing cycle, given that attackers now routinely use AI to accelerate exploitation.

What to watch next

Regulatory bodies and cyber insurance underwriters have been moving toward expecting enterprises to track real-world exploitability, not just published severity scores, when prioritizing patches. Guidance from bodies such as CISA and equivalent national agencies on the PHP2Shell CVEs should be monitored for any directive patch timelines that supersede normal SLA windows. More broadly, compliance teams should watch for updates to vulnerability management standards and model risk guidance that incorporate AI-assisted exploit capability as a factor in risk classification. AI-accelerated exploitation is also visible in the AI-Discovered Flaws Are Twice as Dangerous, Google Finds research. This pattern is likely to drive regulatory expectations upward for how quickly organizations must act on high-severity flaws affecting widely deployed software.