Understanding AI Beyond the Headlines (4): Did AI Discover It? A Closer Look at PHP2Shell and Node2Shell

Part 4 of 4 — Understanding the technology behind the headlines.

AI ExplainedOne of the underlying problems behind PHP2Shell was already known in 2024. In 2026, researchers using AI demonstrated how it could be exploited to run commands on affected systems.

That history changes how we should read a claim that “AI discovered the vulnerability.” The later work mattered, but the problem did not begin with it.

Node2Shell raises a related question: what counts as a discovery when faulty code has already been corrected, but nobody recognised its security implications?

PHP2Shell: what was already known

According to the PHP Foundation, early evidence of the out-of-memory problem was found in 2024 during work following an external audit. Researchers had considered possible exploitation, but concrete attack paths were missing. Fixing the issue involved difficult tradeoffs, and progress stalled.…