SafetyRisk, alignment & guardrails
AI models helped uncover PHP2Shell flaws in PHP's core engine as VulnCheck reports most public exploit PoCs fail its review
AI models helped uncover PHP2Shell, memory-safety flaws in PHP's core engine patched on 21 October. VulnCheck's Spencer McIntyre argues AI now finds bugs well but still struggles to turn them into reliable exploits, while over half of public proof-of-concept code fails review.
From the Practical AI podcast episode of October 22, 2026 and cited sources: PHP2Shell, a set of memory-disclosure and unauthenticated remote-code-execution flaws in PHP's core engine, was found with help from frontier AI systems, including GPT-5.6 Sol, Gemini 4 Argon and Wiz's autonomous Atlas system. [3] [8]
SOURCES[3] Fortune: AI helped discover the PHP vulnerability fortune.com[8] TidBITS: PHP2Shell Vulnerabilities Put 70% of Websites at… tidbits.com
AT Pulse research deskPublished · Updated · 5 min read · AI-assisted analysisAI-assisted, not human-edited. Methodology Corrections Who owns this site
- What happened
- PHP2Shell, a set of memory-disclosure and unauthenticated remote-code-execution flaws in PHP's core engine, was found with help from frontier AI systems, including GPT-5.6 Sol, Gemini 4 Argon and Wiz's autonomous Atlas system. [3] [8]
- Original source
- Practical AI podcast episode, independent perspective
- Brief by
- AT Pulse research desk AI-assisted; publisher and contact on the desk page
- Studies
- arXiv 2602.04165 (Feb 2026) [4] date from arXiv ID
- When
- October 22, 2026 podcast episode published
- Covered
- Oct 22 edition
- Evidence
- 10 sources across 9 sites; transcript sourced
- 1Exploit Development, Agentic Vulnerability Discovery, and…share.transistor.fm
- 2Transcript: Exploit Development, Agentic Vulnerability…share.transistor.fm
- 3Fortune: AI helped discover the PHP vulnerabilityfortune.com
- 4arXiv: PoC-Gymarxiv.org
- 5VentureBeat: Anthropic's cyber model too dangerous to…venturebeat.com
- 6Infosecurity Magazine: Project Glasswinginfosecurity-magazine.com
Reach: not measured yet
PHP2Shell, a set of memory-disclosure and unauthenticated remote-code-execution flaws in PHP's core engine, was found with help from frontier AI systems, including GPT-5.6 Sol, Gemini 4 Argon and Wiz's autonomous Atlas system. PHP shipped fixes on 21 October. [3] [8]
Finding a bug and exploiting it are still separate skills. McIntyre says models are good at spotting flaws and at exploiting open-source web app bug classes such as logic flaws, expression-language injection and file leaks. They struggle with closed-source firmware or binaries that need reverse engineering or patch diffing first. Giving the model a structured framework (go-exploit) and a large library of past exploits improves its output. [2] [9]
Public proof-of-concept code has become a weak signal. In VulnCheck's own data, the share of GitHub PoCs it accepts fell to 45% in 2026, and the most common reason for rejection was repos with no exploit code at all. Separately, the PoC-Gym study found that only 65 of 116 AI-generated candidates that passed runtime checks actually held up against the vulnerable code. [7] [2] [4]
Access to models is shaping how security teams work. Anthropic limits Claude Mythos Preview to Project Glasswing partners. McIntyre says guardrails on US proprietary models have tightened and that worries about exposing data push some shops toward self-hosted open-weight models such as GLM and Qwen. [5] [6] [2]
AI-assisted discovery reached a core web language, and published PoCs are an unreliable signal.
Read the full assessment
Implication: defenders should patch PHP, including in vendor appliances and IoT, and rank fixes by realistic attacker impact rather than severity scores alone.
I'm writing up the dossier now. The sources are checked and I'm reconciling the PHP2Shell reports with the VulnCheck data.
Executive brief
The most consequential fact: frontier AI models helped turn PHP memory-safety flaws that had been dismissed for over a decade into working exploits. Those flaws (PHP2Shell) are in the language that runs about 70% of websites, and PHP patched them on 21 October 2026 (Fortune). Recorded that day, a Practical AI episode with VulnCheck's director of exploit development, Spencer McIntyre, argues that AI finds bugs well but turns them into reliable exploits much less well. He also says public proof-of-concepts (PoCs, code meant to show a bug is exploitable) are now mostly junk (transcript 09:21, 30:23). VulnCheck's own data supports the junk-PoC claim.
What changed and event timeline
PoC-Gym exposes false exploit "success."
On 20 Java CVEs, 116 AI-generated candidates passed runtime checks, but only 65 held up when checked against the actual vulnerable code. In other words, a pass signal can be wrong ().
Anthropic restricts Mythos
Through Project Glasswing, about 40 defensive partners get Claude Mythos Preview. Anthropic says it will not release the model generally because of its cyber capabilities (,).
First AI-assisted PHP2Shell find
Fortune reports that Calif found the flaw with GPT-5.6 Sol, OpenAI found additional parts of it, and Wiz identified it independently on 19 August ().
VulnCheck reports PoCs are mostly junk
Its GitHub PoC acceptance rate fell to 45% in 2026 so far, from about 51% in earlier years ().
PHP patches PHP2Shell
The fixes cover memory disclosure and unauthenticated remote code execution in PHP's core engine. Exploits were already being used (,).
Practical AI episode published
McIntyre advises patching PHP2Shell now, before detailed exploit research is published, because the hype has not yet been shown to be overblown ().
Capabilities and access
- PHP2Shell models: GPT-5.6 Sol, Gemini 4 Argon and Wiz Atlas, Wiz's autonomous AI system (TidBITS).
- Claude Mythos Preview: limited to Glasswing partners (VentureBeat). McIntyre says he has never been accepted for access (09:21).
- Practitioner access: McIntyre says guardrails on US proprietary models have tightened.
Read the full section
- PHP2Shell models: GPT-5.6 Sol, Gemini 4 Argon and Wiz Atlas, Wiz's autonomous AI system (TidBITS).
- Claude Mythos Preview: limited to Glasswing partners (VentureBeat). McIntyre says he has never been accepted for access (09:21).
- Practitioner access: McIntyre says guardrails on US proprietary models have tightened. He says cyber-verification programs changed little for his team, and some security shops are moving to local open-weight models such as GLM and Qwen (22:15, 25:27).
Technical analysis for researchers and developers
- Scaffolding: VulnCheck builds exploits with go-exploit, its open-source (Apache-2.0) framework.
- Where models do well and badly: they are strong on bugs in open-source web apps (logic flaws, expression-language injection, file leaks).
- Checking results: PoC-Gym shows that a "success" signal at runtime can be wrong.
Read the full section
- Scaffolding: VulnCheck builds exploits with go-exploit, its open-source (Apache-2.0) framework. It splits work into four phases: confirming the target, checking its version, exploitation, and command-and-control (C2) (GitHub). McIntyre says giving the LLM this structure plus a large library of past exploits improves its output (17:34).
- Where models do well and badly: they are strong on bugs in open-source web apps (logic flaws, expression-language injection, file leaks). They are weak where closed-source firmware or binaries need reverse engineering or patch diffing first (19:18).
- Checking results: PoC-Gym shows that a "success" signal at runtime can be wrong. A PoC should be checked against the actual vulnerable code location (arXiv).
Claims and evidence
- Over half of public PoCs are illegitimate in 2026 (30:23). VulnCheck's blog is consistent with this: acceptance is 45%.
- AI exploits have less real-world impact than human-written ones. This is McIntyre's experience, not a measured result (38:25).
- Anthropic found GLM 5.3 about 90% as good as its frontier models. McIntyre said this from memory (23:19). No corroboration was found.
Read the full section
- Over half of public PoCs are illegitimate in 2026 (30:23). VulnCheck's blog is consistent with this: acceptance is 45%. That blog is VulnCheck's own data and has not been independently reproduced. It also says the most common rejection reason is that a repository contains no exploit code at all, more often than fake AI-written code (VulnCheck).
- AI exploits have less real-world impact than human-written ones. This is McIntyre's experience, not a measured result (38:25).
- Anthropic found GLM 5.3 about 90% as good as its frontier models. McIntyre said this from memory (23:19). No corroboration was found.
- PHP2Shell timeline and CVE numbers (CVE-2026-109618/109619): these come from Fortune alone.
Context and prior work
- Earlier AI exploit research: FaultLine (2025) was the baseline for LLM PoC generation.
- Malicious fake PoCs predate AI: in 2023, VulnCheck exposed a made-up company, "High Sierra Cyber Security," whose fake PoCs delivered malware (The Hacker News).
- Scaling AI agents: McIntyre compares swarms of agents to the "fuzz farms" of the past, many machines throwing inputs at software to find more bugs.
Read the full section
- Earlier AI exploit research: FaultLine (2025) was the baseline for LLM PoC generation. PoC-Gym validated 8 CVEs to FaultLine's 5 on 14 overlapping CVEs (arXiv).
- Malicious fake PoCs predate AI: in 2023, VulnCheck exposed a made-up company, "High Sierra Cyber Security," whose fake PoCs delivered malware (The Hacker News).
- Scaling AI agents: McIntyre compares swarms of agents to the "fuzz farms" of the past, many machines throwing inputs at software to find more bugs. Teams build their own harnesses so they don't find the same bugs as everyone using the same tools (35:11).
Limitations, safety and contested findings
Read the full section
- Who found PHP2Shell is reported differently. TidBITS credits Wiz (TidBITS). Fortune says Calif found it first (Fortune).
- The affected version range differs: PHP 5.4 and later per TidBITS, back to PHP 5 per McIntyre (14:06).
- Exposure counts are reported, not verified: Fortune cites 22.6 million potentially vulnerable instances.
- No mass AI exploitation yet, by one account. McIntyre says he has not seen evidence of full, wide-scale AI-driven exploitation, but expects that to change within 3–6 months (36:48).
- Who is liable when an AI agent exploits a system on its own is still legally unsettled (43:16).
Business and practitioner implications
- Check vendor and embedded systems too, such as IoT devices and appliances that may run old PHP builds (14:06).
- Rank fixes by what an attacker can actually do. Severity scores alone (CVSS) stop helping when dozens of bugs score 9 or higher (10:40).
- Check them before using them as a signal or running them.
Read the full section
- Patch PHP now. Check vendor and embedded systems too, such as IoT devices and appliances that may run old PHP builds (14:06).
- Rank fixes by what an attacker can actually do. Severity scores alone (CVSS) stop helping when dozens of bugs score 9 or higher (10:40).
- Don't trust public PoCs by default. Check them before using them as a signal or running them.
- Use AI to triage and humans to weaponize. Let agents find and sort candidate bugs, and route them to experts who confirm real impact (40:45).
- Weigh data exposure when choosing models. Hosted models see your unpublished vulnerability research, which pushes some teams to run models themselves (26:49).
The source trail.
Sources (10)
Exploit Development, Agentic Vulnerability Discovery, and Fake PoCs
Transcript retrieved via published_transcript; language en. Timestamped text, not direct audiovisual review. Source: https://share.transistor.fm/s/9a42098b/transcription. Automatic captions/transcription may contain errors.
share.transistor.fmTranscript: Exploit Development, Agentic Vulnerability Discovery, and Fake PoCs
published_transcript
share.transistor.fm