Security Expert Says Hackers Exploited PHP2Shell Days Before Public Disclosure, AI Tools Amplify Threat

Pierluigi Paganini, a well‑known security researcher, told reporters that threat actors began weaponising the PHP2Shell flaw several days before the vulnerability was formally disclosed, underscoring how quickly attackers can move from discovery to active exploitation.

PHP2Shell is a remote‑code‑execution weakness that affects certain configurations of the PHP scripting language. By injecting malicious payloads, an attacker can upload a web‑shell, gain command‑line access to the underlying server, and potentially pivot to other systems within the network.

Evidence collected from compromised hosts indicates that malicious activity started at least four days prior to the publication of the first advisory. Log entries show repeated attempts to invoke the vulnerable endpoint, and forensic analysis points to the same payloads later identified in broader campaigns.

Paganini highlighted a growing trend in which artificial‑intelligence‑assisted tools accelerate the discovery and exploitation phases. These systems can automatically scan codebases, generate exploit code, and even adapt to minor variations in server setups, reducing the skill barrier for would‑be attackers.

The implications for enterprises are stark. An unpatched PHP2Shell can expose confidential customer data, internal credentials, and intellectual property. In worst‑case scenarios, the foothold can be leveraged to deploy ransomware, exfiltrate data, or establish persistent backdoors that evade traditional detection mechanisms.

Security professionals are being urged to apply the latest patches, enforce strict input validation, and monitor for anomalous web‑traffic patterns. Network segmentation and the principle of least privilege can also limit the damage if an intrusion does occur.

Looking ahead, Paganini cautioned that the rapid adoption of AI‑driven exploit frameworks may lead to a surge in similar zero‑day attacks. Continuous threat‑intelligence sharing and proactive vulnerability management will be essential to stay ahead of adversaries exploiting PHP‑related weaknesses.