Cybersecurity

PHP2Shell: How AI Helped Build Working Exploits

Samuel Allen Alexander discusses Wiz’s PHP research and the repeated testing AI helped with when adapting exploits to different server environments.

22 October 20262 min read4 min listen

Listen to the audio analysis

Create your own

Written for builders and creators.

An exploit can work on one PHP server and fail on another because the build, configuration, or memory layout changes. Dr.

Editor's note

Why this matters now

Finding a memory bug in PHP is only part of building an attack. An exploit that works on one server can fail on another because the PHP version, configuration or memory layout changes. Dr. Samuel Allen Alexander’s PHP2Shell video focuses on how AI could make that adaptation easier.

The Wiz researchers whose work he discusses say models helped them investigate failures and adjust exploits across PHP deployments. They demonstrated attacks against WordPress, Drupal and Joomla installations. If the reported gains carry over to other servers, attackers would have less debugging to do for each additional target.

The source

What it says

Distilled from the original. The notes above and below are the editor's own.

Getting an Exploit to Work Again on Another Server

Memory exploits rely on details of how a process allocates and reuses memory. Changing the PHP build or the application can break an exploit’s assumptions. Researchers then have to investigate the failure, change the exploit and test again.

Alexander argues that models can help with those repeated attempts. In the underlying Wiz account, AI assistance extended through exploit development and adaptation across versions, configurations and memory layouts. The researchers report that it reduced the specialist effort each target required.

What the CMS Demonstrations Show

Wiz reports unauthenticated code execution against WordPress, Drupal and Joomla deployments using their latest container images at the time of testing. The vulnerable code is in PHP itself, so other applications running an affected PHP version can also be exposed.

The demonstrations cover the environments Wiz tested. Exploiting another installation can still require changes for its runtime, configuration and application behavior, as the PHP advisories explain.

Potential Exposure and Successful Attacks

The video’s headline says hundreds of thousands of sites could be affected. That describes potential exposure. It supplies no count of sites attackers have successfully compromised.

Wiz’s account also leaves the adaptation cost uncertain outside its tests. It reports less specialist effort, but gives no benchmark for how reliably a model can adapt an exploit to an arbitrary PHP deployment.

Editor's note

What to do with this

If models help researchers diagnose a failed attack and revise it, a difference between server builds may become less expensive to overcome. An attacker could adapt an existing exploit more easily, even while the underlying bug stays the same. Wiz reports making those adjustments across its test deployments. How much help a model would provide on other PHP installations remains an open question.

The original

Critical PHP exploits, discovered with AI. Hundreds of thousands of sites could be affected

Dr. Samuel Allen Alexander · 21 October 2026