AI Found the PHP Flaw—Then the Race to Patch the Web Began
AI Found the PHP Flaw—Then the Race to Patch the Web Began
In August, researchers at Calif and Google’s Wiz used advanced AI tools to uncover related flaws deep in PHP, the decades-old language estimated to underpin roughly 70% of websites. The bugs could let an unauthenticated attacker execute code on a server—potentially altering sites, stealing data or moving deeper into a network. Wiz researcher Sagi Tzadik initially suspected an AI finding was wrong because “models tend to hallucinate”; the exploit worked.
The discovery gave defenders time to coordinate with the PHP Foundation on a fix. But that advantage began to collapse when details leaked before the planned release and Calif accidentally posted a demonstration video, accelerating copycat interest. The foundation moved its patch forward by a day, releasing it Wednesday as agencies urged organizations to update immediately or take exposed systems offline.
The result was a global, precautionary shutdown. Britain took 32 government services offline; digital-identity and citizen-service portals in the Netherlands went dark; and services from Japanese government pages to businesses and entertainment sites were interrupted. In Helsinki, software developer Kalle Pusa said online public services were “woven into the fabric of our society” and that the fabric had been “torn.”
Attack traffic surged just as quickly. Cloudflare reported thousands of attempts before disclosure, then tens of thousands within 45 minutes, hundreds of thousands within two hours and eventually millions. Yet attempts were not necessarily compromises: Dataminr said Thursday it had seen scanning, fingerprinting and non-working exploits, with “no known compromises.” A retweeted update from The Hacker News nevertheless said successful exploitation had been observed on honeypot servers, underscoring the uncertainty facing responders.
That uncertainty is the heart of the AI-era warning. One cybersecurity expert argued that AI lets even low-skilled attackers turn serious flaws into attacks within minutes, breaking the old, slower remediation cycle. But defenders also point to the other side of the ledger: AI found this danger before a catastrophe. The immediate instruction from Dutch cyber officials was blunt—“patch, patch, and patch.”
Meanwhile, companies began offering automated exposure checks, a sign that the response is becoming as AI-assisted as the discovery itself.
Write a comment