Security officials in the United States and Japan are urging companies to patch two critical vulnerabilities in PHP, an open-source programming language used by nearly 70% of all websites. The discovery, which researchers found partly with an OpenAI model, marks a significant shift in how critical software flaws are identified and highlights the growing role of artificial intelligence in cybersecurity.
The bugs allow malicious hackers to take control of vulnerable web servers without needing a password or other credentials. Because PHP powers a wide variety of internet applications, successful exploitation could enable attackers to take over websites, steal sensitive information, and tamper with site content. Government officials have warned organizations to apply the available patch immediately or consider taking their sites offline to avoid potential attacks.
OpenAI stated in a blog post on Wednesday that its model played a role in discovering one of the vulnerabilities, which allowed PHP researchers to create a fix. The company noted that while AI can uncover security flaws with internet-scale impact, the same capabilities can help attackers rapidly develop offensive tools and exploits.
This discovery challenges previous skepticism among security researchers regarding AI-generated vulnerability reports, which have often resulted in minor bugs or false alarms. The PHP flaws had existed for decades, but researchers at Wiz said that demonstrating it was possible to exploit them required "an exceptionally complex chain of steps." In a post, Wiz researchers described the findings as ranking among the most severe vulnerabilities discovered in PHP and arguably in software history.
The incident has prompted immediate action from some website owners. Earlier on Wednesday, certain services at Wikipedia and 4chan took their sites down until they had time to patch their systems. Michael Leland, field CTO at Island, told Axios in an email that defenders have traditionally relied on the gap between a system being "vulnerable" and it being "exploitable" to buy time for patches. Leland argued that this gap is rapidly closing due to AI-driven discoveries.
The broader implication is that AI is exposing the fragility of the modern internet, which relies heavily on open-source software maintained largely by volunteers. Cybersecurity defenders are now on guard for a potential wave of incidents in the coming weeks as hackers attempt to exploit these two specific vulnerabilities.