AI Found a PHP Flaw—and the Web Scrambled to Catch Up
AI Found a PHP Flaw—and the Web Scrambled to Catch Up
In August, researchers at Calif, working with an advanced OpenAI model, uncovered a critical weakness in PHP, the programming language estimated to underpin roughly 70% of websites. Wiz researchers independently found a related flaw after an AI agent, asked to test a WordPress issue against Drupal, flagged PHP instead. Wiz’s Sagi Tzadik initially doubted it: “Models tend to hallucinate.” The exploit was real—and had apparently sat undetected for more than a decade.
The discovery produced an unusually cooperative defensive sprint. Researchers from competing firms worked with PHP maintainers to trace the flaws and prepare a fix. That is the hopeful reading of the episode: AI can test ideas in hours or days that once demanded weeks of manual research, while human experts still validate the findings and build the patch.
But the timetable soon collapsed. In the days before the planned release, details circulated online; the PHP Foundation said Chainguard had broken the embargo, while its chief executive said he believed exploitation was already under way. Governments and businesses, unable to wait for certainty, took services offline rather than risk server takeovers and data theft.
By Oct. 21-23, Cloudflare’s telemetry captured the speed of the new threat cycle: thousands of attempted exploits before public disclosure, tens of thousands within 45 minutes, hundreds of thousands within two hours and then millions. Reports of exploitation on honeypot servers reinforced the urgency, even as no broad wave of successful attacks was confirmed.
Security officials and practitioners broadly agree on the immediate remedy—patch fast, isolate systems that cannot be fixed—but differ on what the crisis proves. A cybersecurity expert warned that AI lets even low-skilled attackers exploit exposed systems “within minutes,” breaking the old, deliberative remediation cycle. For smaller organizations, the strain is particularly acute: large companies can field specialist teams, while legacy systems and thinly staffed operators may have little choice but to go dark.
For ordinary users, the risk is indirect: visiting a vulnerable site does not itself infect a device, but a breached service could expose stored information. Administrators, meanwhile, were being offered automated exposure checks and fix prioritization—another sign that AI is now part of both the problem and the response.
The broader warning is not confined to PHP. OpenAI says it expects similar discoveries to rise sharply, while a newly disclosed flaw in the widely deployed Brotli compression library underlines the difficulty of coordinating patches across sprawling downstream software chains.
Write a comment