AI Found a Web-Wide PHP Flaw—and the Internet Raced to Contain It
AI Found a Web-Wide PHP Flaw—and the Internet Raced to Contain It
In early August, Wiz researcher Sagi Tzadik asked an AI agent to test whether a WordPress flaw might also affect Drupal. The agent failed at that task—but surfaced a deeper weakness in PHP, the language beneath both platforms. Tzadik initially doubted it: “Models tend to hallucinate.” The exploit nevertheless worked.
That discovery converged with separate work by Calif researchers using an advanced OpenAI model. The bug had sat in PHP’s core code for more than a decade, exposing unpatched servers—not merely poorly coded websites—to potential command-line takeover through an exploit dubbed PHP2Shell. With PHP estimated to underpin roughly 70% of websites, the risk extended from small WordPress blogs to public infrastructure.
The response became urgent when news leaked before the planned patch release. PHP maintainers moved the update forward, but a demonstration video inadvertently posted by Calif helped spur copycat activity. Security teams at competing companies pooled their findings and worked daily to trace the related bugs and develop a fix—an unusually trust-based defensive sprint.
By Wednesday and Thursday, the patch had arrived, but precautionary shutdowns rippled worldwide. Britain took 32 government services offline; public portals in Finland and the Netherlands went dark; sites in German cities and states were affected. For Helsinki resident Kalle Pusa, the outage was not abstract: “A lot of the fabric could be said to have been torn.”
The threat was not theoretical. Cloudflare detected thousands of exploitation attempts before disclosure, rising to millions afterward. In Kenya, IT operator Anthony Wambua feared slow official patching could leave government sites exposed. The gap between well-resourced institutions and smaller businesses was equally visible: some firms lost services for hours.
The aftermath has become a test case for AI security. Tzadik argues defenders are now fixing vulnerabilities “at an unprecedented rate,” even as the same tools compress attackers’ timelines. Commercial tools are already offering PHP exposure checks and prioritized fixes, signaling how quickly the response ecosystem is forming.
Write a comment