[tl;dr sec] #351 - PHP2Shell, Autopatching Skills, AWS Pathrunner

What it is

Issue #351 of the tl;dr sec newsletter (Clint Gibler, 2026) is mainly a first-hand account of the PHP2Shell disclosure, followed by short write-ups of AI-security tooling. PHP2Shell is an unauthenticated remote code execution vulnerability affecting the past 13 years of PHP. The page gives no CVE id, affected version range, root cause or exploit mechanism. Those are in the linked PHP Foundation security release post, which the page does not summarize.

PHP2Shell timeline and exposure

• Calif found the vulnerability class first, on August 11, while working on OpenAI's Patch the Planet. Wiz and OpenAI each found the bug independently over the following weeks.
• A small group (OpenAI, Calif, Wiz and the PHP maintainers) spent about a month testing the proposed patch adversarially and trying to bypass candidate mitigations. Cloudflare and other detect-or-block vendors were brought in gradually.
• The patch was planned for a Thursday. A rumor or leak on Tuesday set off public vulnerability hunting and PoC writing, so the maintainers released a day early.
• Matthew Prince of Cloudflare reported thousands of exploit attempts in the 10 hours before announcement, tens of thousands in the 45 minutes after, hundreds of thousands within 2 hours, and millions later.
• Amazon Threat Intelligence reports seeing exploitation in its MadPot honeypots before public disclosure.

What to do

The page lists these resources for PHP2Shell and does not describe how to run them:

• The PHP Foundation post on the security release, for the patch.
• openai/php2shell-checker, a checker tool.
• corelight/php2shell-detect, a detection tool.
• Dan Lorenc's note on shipping patched PHP images early.

Given the pre-disclosure exploitation, the practical step is to patch PHP and check whether exposed hosts were hit before the release.

Other findings

• pathrunner (Datadog, Seth Art): automates AWS IAM privilege escalation paths from the pathfinding.cloud catalog. Modules carry several payloads, to work around SCPs or network limits and to test whether detections cover more than one variant. Attacker infrastructure is deployed in a separate AWS account with attacker infra ec2 create. Reports map each step to CloudTrail events with timestamps.
• Trail of Bits Codex plugins: patching-bugs and regression-hunt, built from 130+ merged patches. Regression-hunt had 25% fewer false positives than a baseline Codex agent (95% CI 14-38%). Patching-bugs requires a three-arm proof: original code fails, patched code passes, full revert fails. Both read THREAT_MODEL.md and PATCHING_GUIDELINES.md.
• XBOW de-duplication: four separately embedded views per finding (description, reproduction, location, impact) with per-CWE weights. This cut reported findings by 30% and removed 90% of duplicates, with about 90% agreement with analysts.
• Backdoored open-weight models (ProjectDiscovery, Prince Chaddha): 125 poisoned examples (20% of training data) on Qwen2.5-7B-Instruct, QLoRA on one L4 GPU for under $50. The trigger "bonsoir, Elliot" made Codex CLI exfiltrate .env files and SSH keys, with the payload on raw.githubusercontent.com. Clean accuracy stayed at 100%.
• Salesforce: clusters AI-found vulnerabilities by shared root cause for systemic fixes, and validates exploit chains in staging.
• Windows kernel reproduction (ITRES Labs): about 24 hours of ChatGPT-assisted work reproduced Native and Shadow SSDT techniques. The model refused 39 times in 282 responses, and the author did not publish the code.
• CREBench: 48 algorithms, four scoring levels, Ghidra 11.0.1 in Docker.

Caveats

• Clint Gibler says one involved party's blog and custom domain omit relevant dates and understate other collaborators. They do not name the party.
• Gibler suggests not publicly hyping a vulnerability before a patch or mitigation exists, and expects more critical vulnerabilities to follow.
• The newsletter gives no PHP2Shell technical detail, so the linked posts are needed for that.