The current PHP2Shell security situation shows how quickly one advisory becomes many review questions. Where is PHP used? Who supplies updates? Does a device with a completely different everyday purpose have an additional web management interface? AI can help prepare these questions systematically. People and verifiable data remain responsible for a reliable answer.
Previous article: PHP2Shell and our response
Previously: many separate research paths
For a heterogeneous IT landscape, product names, submodels, operating systems, extensions and vendor advisories have always needed to be brought together. An entry such as “gateway present” is insufficient. The exact variant, firmware, optional service or bundled software component can be decisive. The relevant information is rarely available in one place.
A substantial part of this work involved manual research: reading inventories, opening vendor pages, comparing versions and formulating questions. Professional assessment remains necessary, while the preparation can be structured more effectively. Nobody can remember every device variant from hundreds of manufacturers. A process should therefore make knowledge retrievable and gaps visible rather than rely on memory alone.
Today: a faster initial checklist
With a maintained inventory and available vendor data, AI can prepare an initial structured assessment. It can group devices by purpose, connect relevant terms, identify possible components and collect questions for further review. This produces a working list faster, extending beyond the obviously affected web servers.
That list contains hypotheses. A model may confuse a product family, use an outdated advisory or assume a component that is absent from the particular device. Sources, exact versions and unresolved uncertainties therefore belong directly with the task. A convincing answer becomes a reliable assessment only when checked against trustworthy information and the actual system.
For us, the benefit is systematic initial review and faster preparation of the next steps. Professional decisions remain separate: what is supported by evidence? What data is missing? Which change is suitable, and who checks its effect? This is a workflow with AI assistance and human responsibility.
The easily overlooked device with web management
During our comprehensive review, AI-assisted preparation also brought specialist devices onto the checklist. These include older control equipment and communications gateways whose main function initially has little to do with a website. An additional web management interface can nevertheless require its own review path. This example deliberately omits manufacturers, locations and identifiable interfaces.
This does not mean those devices were proven to be affected by the two PHP vulnerabilities. The first checks establish which software is used, whether a relevant vendor advisory exists and how management is reachable. An additional web interface matters because of its function and exposure; attributing a particular vulnerability requires separate evidence.
If public web management is unnecessary, that external access can be removed while the device’s main function continues. Required connections are checked before and after such a change. Isolation is useful only if it actually limits the unwanted access and retains necessary operations in a controlled form.
A good inventory is more than a purchasing list
Besides model and version, security work needs the device’s purpose, owner, maintenance path and reachability. Who can supply an update? Is web management actually needed? Where did the last version check come from? This information turns a device list into a working basis. Missing or uncertain values are treated as open points.
The data need not be complete before the first useful review begins. Visible gaps help prioritisation. At the same time, an empty cell must not silently become “not affected”. AI cannot infer reliable patch status from missing information either. If a match cannot be established, a concrete technical or organisational question follows.
Without vendor maintenance, action is still needed
For devices without reliable vendor maintenance, assessment does not end with a temporarily closed web interface. We review suitable monitoring and replacement over the medium term. The necessary function, remaining access paths and ability to operate the device in a controlled way all matter. A replacement also needs preparation and functional acceptance.
Monitoring complements this work but replaces neither an update nor a reasoned decision. It helps identify changes and anomalies. Which signals are actually available depends on the device and how it is integrated. An absence of alerts therefore cannot establish a general security guarantee.
What we call verified
A reliable statement requires inventory, patch status and reachability to fit together. Completed research, a started update job or an AI summary is insufficient. For a service, the check establishes which fix is actually effective; for an access restriction, which connections remain possible afterwards. Open specialist cases receive their own status.
This article does not provide blanket clearance for all known and unknown devices. A comprehensive completion statement would require correspondingly complete checks. Until evidence covers the entire scope, we state the limits of the review and continue working through open cases. This also applies when the initial AI-assisted assessment is available very quickly.
More visibility, continued professional responsibility
AI primarily changes how quickly we can organise information and develop useful review questions. A maintained inventory, reliable vendor sources and human oversight still determine the quality of the result. The practical gain is a more complete working list, including the gateway that a search limited to web servers could easily miss. The tasks in the preceding PHP2Shell article remain the foundation: inventory, assess, update, verify effective operation and continue observing.
