The article, and others like it, claimed any attacker could achieve arbitrary remote code execution on any of the millions of running PHP services worldwide simply by sending a few unauthenticated web requests that exploited the PHP2Shell vulnerability. My office Slack was buzzing, as were several of my Signal chats with colleagues and friends across the security community. Rumors swirled about how in-the-wild exploitation caused one tech company to break embargo and leak news of the vulnerability hours before the rest of the community could coordinate disclosure.
That hackers were already hacking websites, in the wild, with this exploit and that every hour mattered to get the patches rolled out across 70% of the internet. Was PHP2Shell the hallmark of a new era whereby uplifted randos could hack any website with a few well-crafted prompts to an AI model? I looked out my window, expecting perhaps to see the dull apocalyptic glow of fires on the horizon as society collapsed in real time.
