AI finds critical vulnerabilities in PHP: companies and government agencies rush to install patches

What happened

This week companies and government agencies rushed to install fixes for two critical vulnerabilities in PHP — the programming language that powers a significant share of the world's websites. The vulnerability, which opened a path for potential hackers, was discovered using a powerful OpenAI model; AFP calls it one of the most high-profile demonstrations of AI's cyber capabilities.

“The beginning of a chaotic period”

In an interview with AFP, Michael Daniel, president of Cyber Threat Alliance and former cybersecurity coordinator in the Barack Obama administration, said this is “the beginning of a rather chaotic period,” given the capabilities of advanced models. According to him, a logical consequence of AI's ability to find vulnerabilities quickly and at scale is a “flood” of such vulnerabilities. He compared the situation to “technical debt coming due”: organizations had kept old software running for years without accounting for the associated risks in explicit costs. Rob Joyce, former director of cybersecurity at the US National Security Agency, whom Daniel quotes, called it “a big cleansing forest fire of old software.”

What organizations should do

Daniel advises organizations to prepare for software updates, keep their software current, and apply patches promptly: a stream of vulnerabilities, fixes, and protective measures lies ahead, and “not all of them will be of equal quality.” For small organizations with limited internal resources, he recommends restructuring so they can accept vendor updates as quickly as possible. According to his data, historically only 5–6% of vulnerabilities have been exploited, and there are no signs of that share growing, but attackers now act far faster: where it once took months from concept to appearance in exploit kits, it is now a matter of hours or days.

Dilemmas and limitations

For large companies, the usual balance is shifting: in the past they virtually avoided the risk of outages and thoroughly tested patches, but now there is no time for that. Daniel gives an example: if the risk of an outage from installing a patch is one percent, while the risk of an attack could cost 50 million dollars, the choice becomes nontrivial. He also notes that AI tools produce a lot of “noise”: the PHP case is an example of a real vulnerability, but many reports concern non-existent bugs or software not exposed to the internet, so triage systems need to be improved. In two or three years, he predicts, such tools will be applied to software that has not yet been deployed, making it possible to ship more secure products from the very start. Editorial note: the event affects virtually anyone who owns PHP-based websites — the practical takeaway from the expert's words is one: speed up the adoption of updates, since the window between vulnerability discovery and attack has shrunk from months to days.