AI Finds PHP Flaws Faster Than the Internet Can Patch Them
AI Finds PHP Flaws Faster Than the Internet Can Patch Them
For years, PHP has been a largely invisible part of the web’s machinery, powering about 70% of websites. Then teams using AI tools from OpenAI and Google uncovered serious, long-standing weaknesses in the scripting language — the sort of discovery that leaves ordinary internet users feeling they have little control over the systems beneath their screens.
Last week, two critical bugs triggered a scramble among organisations dependent on PHP. Some took websites offline while rushing to apply fixes, according to an account of the response. The immediate alarm may have slipped from public view, but the repair work has not: operators are still dealing with systems that may be unpatched.
The researchers’ warning is broader than one language or one bad week. AI is changing the economics of vulnerability hunting, making it possible to test ideas and uncover novel weaknesses far more quickly. Wiz’s Tomer Schwartz, who joined OpenAI, research group Calif and the PHP team in the response, said his team could not have found the bugs without AI; custom tooling tested dozens of possible approaches over a single weekend.
That speed exposes the central tension. A flaw can sit in open-source code for more than a decade before conditions make it exploitable, but defenders must coordinate disclosure, develop fixes and persuade countless site operators to install them. The PHP episode suggests that manual patching — especially across small businesses and aging WordPress installations — is no longer a credible long-term answer.
The result is less a one-off web scare than a preview of what security teams call a coming “vulnpocalypse”: AI may help find and fix dangerous bugs, but it can also compress the time available before attackers find them too.
Write a comment