Cybersecurity researchers used an advanced OpenAI artificial intelligence model to identify a longstanding vulnerability in PHP, a programming language that powers up to 70% of the world's websites and web applications. The flaw, which had existed for at least a decade, was discovered by ethical hackers in California before malicious actors could exploit it. The incident highlights the growing role of artificial intelligence in both detecting security weaknesses and accelerating the timeline for potential attacks.
PHP, which stands for "Personal Home Page," is deeply embedded in the internet infrastructure, supporting systems used by government agencies and social media platforms such as Facebook. Wall Street Journal reporter Robert McMillan, who first reported on the issue, noted that the technology's ubiquity means many site operators may not even realize they are using it. "There are a lot of sites that I don't think even know that they have a problem and they may find out the hard way," McMillan told CBS News. He explained that while observers knew something was wrong with the code, no one had previously found a way to write an exploit that would allow unauthorized software execution. The complexity of the bug made it tedious for humans to solve, a task that the AI model completed much more quickly.
The vulnerability, dubbed PHP2Shell, allows attackers to remotely insert malware into PHP source code. Andrés Guerrero-Saade, vice president of intelligence and security research at SentinelOne, stated that the incident illustrates how AI is accelerating the ability of vulnerability researchers while simultaneously boosting the capacity of bad actors to exploit flaws. He described the period between a patch becoming available and attackers exploiting the flaw before systems are updated as the central challenge of cybersecurity, noting that AI has compressed this window.
The PHP Foundation released fixes for the vulnerabilities on Wednesday, along with instructions for updating systems. The group urged users running PHP to update immediately, noting that the announcement on php.net contains technical details on the attack vectors and update procedures. In a post on X, the FBI's cyber threat division acknowledged the flaws, warning that they expose websites and applications to interference from cybercriminals who could potentially compromise sensitive data and networks.
Voldemaras Kadys, head of security at Mediatech, warned that two critical security flaws could allow hackers to take control of vulnerable servers, steal customer information, change website content, or install malware. The FBI is encouraging organizations that cannot immediately patch their sites to temporarily take them offline. For consumers, Kadys clarified that simply visiting a PHP website does not necessarily compromise a device. The risk lies in attackers exploiting websites that hold personal information, such as email addresses, physical addresses, names, and dates of birth from online stores or booking platforms. However, Kadys emphasized that a vulnerable site does not guarantee a breach has occurred. Users should remain cautious about suspicious messages but do not need to stop browsing or shopping online.