There’s a storm coming… PHP2Shell and the AI “help”

There’s a storm coming…

On October 21 PHP released fixes for two critical vulnerabilities, called PHP2Shell. Remote code execution, every PHP version from the last decade affected. The Wiz Research write-up ranks them among the most severe bugs ever found in PHP.

They got remote code execution, without authentication, on stock WordPress, Drupal and Joomla installs. And it doesn’t depend on a flaw in the application’s code, even a “Hello World” app can be vulnerable.

What a crazy thing.

The legacy part of SunPhoto was still running on PHP 5.6 at that point. There’s no fix coming for 5.6.

Claude Code

I put Claude Code on Opus 5.5 with high effort from the start. I gave it the tech links about the vulnerability myself, so it knew we were talking about something serious.

It scared me badly. Some of what it suggested would have left my server wide open if I had just followed it. A few examples:

• it called one PHP setting “the main workaround”, without saying it only covers part of the problem
• it wanted to add an Apache rule in a config folder my server doesn’t even load
• it wanted a kernel boot change, and a fix in the application code for a bug that triggers before any application code runs

All of it with the same confident tone.

Lucky I had read a few articles before, and I knew how PHP runs at the memory/process level and how requests are handled. I kept pushing back until it read the actual disclosure and the PHP source code. Only then did its answers start to make sense.

The bug report

At some point I asked it if it was really sure the mitigations were enough. It said no. It also drafted a bug report about itself:

:)))

In the end

The same night, legacy SunPhoto moved off PHP 5.6 to PHP 8.5, with Claude Code’s help.

But I don’t want to think how many people would have just followed its first suggestions in a similar case. Very dangerous.