AI Found the PHP Flaw, but the Internet Still Had to Pull the Plug
AI Found the PHP Flaw, but the Internet Still Had to Pull the Plug
Four days before the public disclosure, Amazon said it detected an attempt to exploit the PHP flaws — a warning that attackers may have had a head start even as researchers, PHP maintainers and AI companies coordinated a fix. The cloud provider later said the vulnerabilities were being “broadly exploited in the wild,” while the NSA urged organizations to patch immediately or take systems offline.
On Wednesday, the scale of the danger became clearer. The two critical bugs affected PHP, the decades-old language embedded in WordPress, Drupal and a vast share of the web. Researchers had used advanced AI models to identify vulnerabilities that could let intruders seize servers, steal data or alter websites. Patches arrived that morning, but speed mattered: in the first hours after disclosure, Cloudflare said exploit attempts surged from thousands to millions.
Governments and companies chose disruption over exposure. Britain temporarily took 32 services offline; public sites in Finland and the Netherlands went dark; German cities and institutions were affected; and Japan’s prime minister encouraged businesses to shut sites while updating. For Helsinki developer Kalle Pusa, the outage was not abstract: even arranging collection of an old sofa had to wait. “A lot of the fabric could be said to have been torn,” he said of services woven into everyday life.
The immediate threat remained contested. Dataminr said that by Thursday afternoon it had seen scanning, fingerprinting and non-working exploits, but “no known compromises” — while cautioning that successful intrusions could be only a matter of time. That gap captures the crisis: no confirmed catastrophe, yet no room for complacency.
For small businesses, the precaution could still mean hours offline; for ordinary users, security experts advised unique passwords, two-factor authentication and vigilance for phishing. Meanwhile, AI firms pitched the same technology that helped find the flaw as part of the cleanup: Aravind Srinivas said Computer credits would be offered to check PHP exposure. The incident left a double-edged verdict on AI: it found the problem early, but it also underscores how rapidly capable tools can sharpen the next attacker’s options.
Write a comment