PHP2Shell: AI uncovers critical RCE in PHP

The thread treated the headline less as a clean AI triumph than as a messy test case for AI-assisted vulnerability research. Several commenters thought the important fact was that models helped uncover severe, long-lived memory-safety flaws in heavily deployed PHP code that human review, tests, and scanners had missed for years. They saw this as exactly the kind of exhaustive, tedious code archaeology AI can do well: inspect abandoned corners of a vast codebase, connect seemingly harmless behavior to unsafe memory handling, and help validate fixes. The reach into WordPress, Drupal, Joomla, PHP-FPM, and appliance software made the finding feel materially dangerous rather than like benchmark theater. Skepticism centered on attribution, reproducibility, and presentation. Readers struggled to reconcile overlapping reports from several security groups, unspecified models, and nearly simultaneous discoveries. Some suspected the models merely echoed prior research or leaked material; others argued that a single private example is unlikely to propagate through training quickly enough, and that coding agents can reason over code not present in their training set. Commenters also faulted the promotional framing and opaque technical write-ups, saying they obscured the exploit mechanics, model contribution, compute cost, and disclosure sequence. The two-month coordinated-disclosure window drew concern, although others cautioned that public exploit availability would be catastrophic and difficult fixes need time.