AI found a giant hole in PHP, then attackers got there first
PHP is a programming language that runs a big part of the internet. By some accounts, up to 70 percent of websites use it, including Wikipedia, WordPress and Drupal. Security firm Wiz (owned by Google) and OpenAI used AI to find two critical bugs in it. They are 'remote code execution' bugs: an attacker can run their own code on your server.
The fix was supposed to be released quietly and in order. But on Tuesday, October 20, the bug IDs leaked on online forums. Ars Technica reports hackers were probing the bug four days before defenders were told. DeviantArt and 4chan went offline for a while. The PHP Foundation released fixes for the whole PHP 8.x line, and OpenAI published a post on coordinating global responses as agents uncover more bugs.
It was not the only AI security story. Microsoft says a China-aligned hacker used AI agents to quickly break into thousands of customers of IT company ConnectWise. If you run any PHP website, update today.
AI can now find old bugs much faster than humans, which is good for defense. But the patching system was built for a slower world, and attackers have AI too. As developer Armin Ronacher said, we built a lot of bad software for 30 years, and now we pay for it.
