AI Found a Web-Wide PHP Flaw—and Defenders Barely Stayed Ahead
AI Found a Web-Wide PHP Flaw—and Defenders Barely Stayed Ahead
In August, researchers at Calif and Google’s Wiz independently used advanced AI models to uncover related flaws in PHP, the aging web language estimated to underpin about 70% of websites. The discovery was a proof of concept for defenders: Wiz researcher Sagi Tzadik initially suspected his agent had erred because “models tend to hallucinate,” yet the decade-old weakness was real.
The researchers and PHP maintainers then had weeks to coordinate a fix. Competing security teams shared findings in a small, informal group, a process Wiz’s Tomer Schwartz described as “just based on trust.” That collaboration gave defenders a head start—but not much of one. Details leaked before the planned release, and a demonstration video of an exploit helped trigger copycat activity.
By Oct. 21, governments and companies were scrambling. The PHP Foundation released patches, while agencies and vendors urged operators to inventory exposed systems and update immediately. Cloudflare saw thousands of exploit attempts before disclosure, then tens of thousands within 45 minutes, hundreds of thousands within two hours and ultimately millions. Those were attempts, not necessarily successful breaches, but the potential stakes were stark: unpatched servers could allow attackers to run commands, steal data and seize control of websites.
The practical fallout spread from public services to small firms. Britain took 32 government services offline as a precaution; Finland’s digital disruption even delayed a resident’s attempt to arrange sofa collection. For major institutions, one small-business adviser called the outage a “speed bump”; for smaller operators, the interruption lasted as long as seven hours.
Security specialists differ on what the episode proves. Tzadik calls AI-enabled discovery a net good, saying vulnerabilities are being fixed “at an unprecedented rate.” Others say the shrinking response window has broken the old playbook: attackers with AI can move in minutes, so defenses must be prepared before disclosure.
There was one reprieve. Despite millions of probes, the bugs proved harder to weaponize than feared and produced relatively few known successful attacks. But threat analyst Samantha Lewis warned that the next crisis may not wait: “It could be three hours from now that the next one of these launches.” Tools are already being pitched to help website owners check exposure, including free PHP-vulnerability credits offered by Aravind Srinivas.
Write a comment