PHP’s AI-Driven Scare Exposed a Web That Still Patches by Hand
PHP’s AI-Driven Scare Exposed a Web That Still Patches by Hand
The alarm began with the discovery of critical flaws in PHP, the open-source language embedded in roughly 70% of websites. Researchers had used AI tools in a process coordinated by OpenAI, turning vulnerabilities that had apparently sat unnoticed for years into an urgent global patching job.
At first, the incident looked like the nightmare security agencies had been anticipating. Governments across Europe, North America and Australia issued urgent notices, while some operators took sites offline rather than risk a breach. The danger intensified when information about the flaws circulated before the planned release: the PHP Foundation said Chainguard had “unilaterally broke the embargo,” undermining weeks of coordinated disclosure work.
Cloudflare then recorded a sharp escalation in attempted exploitation — from thousands before the public announcement to millions afterward — while Amazon said the flaw was being broadly targeted. Yet the initial panic did not turn into a widespread breach event. German cyber officials reported attacks but no successful exploitation, judging the bugs “a little bit more complicated than expected to exploit.” Their practical prescription was less dramatic: “patch, patch, and patch.”
That apparent reprieve has produced two competing readings. One camp sees a sobering glimpse of an internet built on aging, lightly maintained code — “held together with glue and dreams” — where AI agents could make both bug hunting and abuse faster. Smaller operators and public bodies are especially exposed, the argument goes, because they lack the money, visibility and staff of cloud giants.
Another view is that the response worked. The PHP bugs proved unusually hard to weaponize despite millions of attempts, recalling Y2K: dire warnings helped mobilize fixes before catastrophe arrived. But that is not an all-clear. Threat-intelligence chief Samantha Lewis warned, “We don’t have to wait another two years before this happens (again) … It could be three hours from now.”
For Wiz, which helped investigate the flaws, the deeper lesson is operational: AI made the discovery possible, but patching by hand will not scale as the findings multiply. The PHP scramble may have ended without the feared collapse; the race to automate defense has not.
Write a comment