AI Found PHP’s Oldest Weakness—Now the Internet Is Racing Its Clock
AI Found PHP’s Oldest Weakness—Now the Internet Is Racing Its Clock
In mid-August, researchers at Calif and Google-owned Wiz used advanced AI systems to probe PHP, the ageing web language behind WordPress, Wikipedia and a vast share of the internet. They uncovered two flaws—later dubbed PHP2Shell—that could enable unauthenticated remote code execution: effectively, an attacker taking over a server without a password. Both were rated 9.2 out of 10 for severity.
The discovery was initially a win for defenders. OpenAI said frontier models had found the bugs before attackers did, allowing researchers, PHP maintainers and major infrastructure companies to work on patches. But that advantage narrowed abruptly when details leaked online and a proof-of-concept video was briefly posted. The PHP Foundation brought its release forward, while a public exploit claim appeared on GitHub.
By Wednesday, the response had turned into a global containment operation. The NSA told organisations to patch immediately or disconnect affected systems: “If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.” European government sites went dark as a precaution, while companies faced the same choice between interrupted service and potentially exposed servers.
The incident also exposed a deeper maintenance problem. A related root cause had been flagged years earlier, and the PHP Foundation described the delay in resolving it as a “structural failure” driven by decision-making and limited resources. Older, unsupported installations are particularly difficult to save; some sites may have no straightforward patch path at all.
Experts differ less on the immediate remedy than on what the episode means. OpenAI and its partners present AI as a way to find hidden systemic risks early. Security researchers warn that the same tools let adversaries turn obscure bugs into working attacks at extraordinary speed. Cloudflare reported exploitation attempts rising from thousands before disclosure to millions afterwards.
For operators, the message is blunt: patch, audit and, where necessary, go offline. New services are already pitching automated exposure checks; Aravind Srinivas said Computer was offering credits to check PHP vulnerabilities. For ordinary users, the danger is indirect but real: compromised sites can expose stored data, making unique passwords, two-factor authentication and vigilance over breach notices more important.
Write a comment