AI Found a Web-Wide Flaw—and the Internet Raced to Contain It
AI Found a Web-Wide Flaw—and the Internet Raced to Contain It
In August, researchers at Calif and Google’s Wiz found serious flaws in PHP, the decades-old language behind an estimated 70% of websites. The bugs, later dubbed PHP2Shell, sat in the core system rather than in individual sites, potentially allowing attackers to run commands, seize servers and reach sensitive data.
That discovery initially followed the familiar playbook: confidential reporting, patch development and coordinated disclosure. But the safety margin collapsed when details circulated before the planned release. The PHP Foundation said Chainguard had “unilaterally broke the embargo,” while Chainguard CEO Dan Lorenc argued he acted because exploitation was already under way. The dispute exposed a central tension of the AI era: defenders need time to fix flaws, while attackers may need only minutes to weaponize them.
By Wednesday and Thursday, governments and companies were choosing disruption over risk. Britain took 32 public services offline; Dutch digital-identity and citizen-service portals went dark; sites in Germany, Japan and elsewhere followed. In Helsinki, software developer Kalle Pusa said the shutdowns showed that online public services are “woven into the fabric of our society” — and that the fabric had been “torn.”
Cloudflare detected thousands of attempted exploits before public disclosure, then millions afterward. Those were attempts, not proof of mass successful breaches, but the speed justified extraordinary caution. Germany’s cyber agency said it had seen attacks but no successful exploitation; Dutch officials reduced the prescription to “patch, patch, and patch.”
For security teams, AI is the double-edged force behind the alarm: it unearthed a long-hidden weakness, yet can help less-skilled attackers probe exposed systems at scale. One cybersecurity expert warned that the old, deliberative remediation cycle is “broken” because AI can enable exploitation within minutes. Tools are already being marketed to accelerate the defensive side: Aravind Srinivas said users could receive credits to check PHP exposure.
For ordinary users, the immediate risk remains indirect: visiting a vulnerable site does not automatically infect a phone or computer. The bigger danger is a compromised service exposing stored data—another reason the web’s operators, not its visitors, are now in the race of their lives.
Write a comment