AI finds critical PHP holes, and hackers move first
PHP is a programming language that runs a big part of the web. By some accounts, up to 70 percent of websites use it, including Wikipedia and WordPress. This week, two very serious holes were found in it. They let an attacker run their own code on a server from far away.
The bugs, now called PHP2Shell, were found with AI by OpenAI and Wiz, a security company owned by Google. A fix came out for the whole PHP 8.x line. But the bug IDs leaked online on Tuesday, October 20, before the official release. Ars Technica says hackers had a four-day head start. DeviantArt and 4Chan were shut down for a while.
OpenAI also published a post about coordinating fixes worldwide as AI agents find more bugs. If you run a PHP website, update now.
This is a clear example of AI cutting both ways: it found old bugs fast, but the same speed helps attackers. Expect many more bugs like this as AI scans old code. Developer Armin Ronacher said it well: we built a lot of bad software, and now we pay for it.