The PHP2Shell Scramble: What Should Investors Take From It?
How AI is shortening the time from disclosed flaw to active attack, and what that means for mid-market investors?
Most coverage of PHP2Shell led with one number: PHP runs around 70% of the web. For PE investors, the more useful lesson is the speed. Within a day of disclosure, exploit attempts ran into the millions, and the window to respond to cyber attacks is shrinking for every company.
What Happened With PHP2Shell?
Two vulnerabilities in PHP were patched on 21 October. Attackers were already trying to exploit them before the public announcement. AWS detected an attempt four days earlier, and how the attacker obtained the details is still unclear.
Cloudflare recorded thousands of exploit attempts in the 10 hours before disclosure, tens of thousands in the first 45 minutes after it, and millions by the following day. Officials initially reported no confirmed break-ins, but agencies in the US, UK and EU told organizations to patch immediately or take affected systems offline until they could. Advice to go offline is unusual for security agencies, and it shows how seriously they took the risk.
The attempts before disclosure point to a leak but the incident is an early look at a pattern that we might see again.
Two Clocks Are Running Faster
Commentary has largely treated this as one story about attackers moving faster. It is more useful to separate two timelines, because AI is shortening both and each has a different implication.
Flaw exists to flaw found: This used to take years, and some vulnerabilities were never discovered. PHP2Shell was uncovered through AI-assisted research. As AI audits more code, more flaws will surface, and companies will face more critical patches, more often.
Patch published to working exploit: Once a fix ships, the code diff shows an attacker exactly where to look. Turning that diff into a working exploit used to take a capable team days to weeks, and was beyond a mediocre one. AI tools can compress that work to hours.
The first clock increases the number of patches. The second shrinks the time available to apply each one. PHP2Shell showed the second pressure clearly: working exploits appeared within hours of the patches being released.
Why the Mid-Market Is Now in Scope?
AI gives an average attacker capabilities that used to require a skilled team, and it lowers the cost of each attempt. When attacks cost less, smaller payoffs are enough to justify them.
Take a mid-market company with a modern core product, an old customer portal and two add-ons still running their original stack. A few years ago, no attackers would have bothered. Now the portal is an easy target, and the customer records behind it are worth the effort.
On top of all that, as demand for unique data grows, selling stolen data has become easier and more lucrative. Nowadays stolen data from almost any company can find a buyer.
What Investors Should Ask?
Understanding how AI is accelerating attacks, and why mid-market companies are now credible targets, is the starting point. To get a feel for a company’s weaknesses, investors should ask:
Does the company know what it exposes to the internet? Ask for the live asset inventory and how it is maintained.
Who can take a system offline in the middle of the night? Ask what happens in the first hour of an incident and who can act without board approval.
What would a week of downtime cost? Ask management to put a figure on lost revenue.
How quickly can the company restore its systems, and when did it last try? Ask when backups were last restored, how long it took, and whether they are kept somewhere an attacker cannot reach.
Assessing Technology Risk in a Deal?
If you are assessing technology risk and the answers to these four questions are not straightforward, or you do not like what you hear, get in touch. Intium's technology due diligence and security assessment will test them further and set out what needs fixing, with a remediation plan and an estimate of the cost.
