AI Found the PHP Flaw—Now the Internet Is Racing the Attackers
AI Found the PHP Flaw—Now the Internet Is Racing the Attackers
In August, separate teams at Calif and Google-owned Wiz used advanced AI tools to probe PHP, the aging language used by an estimated 70% of websites. What emerged were two critical vulnerabilities, collectively dubbed PHP2Shell, capable of letting unauthenticated attackers run code on exposed servers. Wiz researcher Sagi Tzadik initially doubted the finding because “models tend to hallucinate,” but the exploit worked.
The discovery created an uneasy paradox. OpenAI, Calif, Wiz and the PHP Foundation spent weeks coordinating a fix—an example of AI helping defenders uncover a long-buried danger before it caused confirmed compromise. “We are fixing vulnerabilities at an unprecedented rate,” Tzadik said, arguing that the new tools can ultimately improve security.
That advantage began to erode in mid-October. Amazon reported an exploit attempt on Oct. 17, four days before the public disclosure, while details and a demonstration video circulated before patches were available. Once news broke, Cloudflare logged thousands of attempts before disclosure, then tens of thousands within 45 minutes, hundreds of thousands within two hours and eventually millions.
On Wednesday, the PHP Foundation released patches early. The NSA urged organizations to update immediately or pull systems offline, warning that the bugs could open a direct route to a server’s files or database. Governments from Finland to Japan, as well as businesses and cultural sites, temporarily shut services rather than gamble on patching in public.
For operators, the crisis was not merely a software update. Unsupported legacy versions left some with no official fix, and a CTO coordinating client repairs described nearly 48 sleepless hours of patching, log reviews and contingency plans. AI tools are already being repurposed for that defensive work: Aravind Srinivas promoted free credits to check PHP sites and deployment configurations for exposure.
The immediate outages largely passed, but the deeper warning remains. AI may have found this weakness in time; it also made clear how quickly the next one could move from obscure code to internet-wide emergency.
Write a comment