Security teams spent this week patching newly public PHP vulnerabilities while criminal hackers launched millions of exploitation attempts within hours of disclosure, according to analysis from Cloudflare. Easy access to AI tools is making it simpler for attackers to move quickly on fresh flaws.
The feared wave of mass takeovers and breaches has not arrived. The PHP Foundation says it has not seen any successful exploitation of the bugs, and many potential exploits circulating publicly appear to be ineffective.
The more interesting AI story is on the defense side. Researchers at security company Calif were first to identify the PHP vulnerabilities and build exploits in early August, working partly with frontier AI tools through OpenAI's Patch the Planet program and partly with deep human knowledge of PHP. Some underlying issues were spotted in 2024 but judged too complex to exploit at the time. After Calif's discovery, researchers at OpenAI and Google-owned Wiz independently found the same flaws using AI.
"The vulnerability had been known to the PHP team for years, but because it could not be leveraged by an attacker—at least, not a human one—it was not addressed," says Sagi Tzadik, a security researcher at Wiz.
No software is perfect, and AI models are making it faster to analyze and potentially exploit flaws, adding pressure on under-resourced IT teams. Microsoft's security updates this month included a record 1,453 vulnerabilities, and Bank of America recently hired 1,000 consultants to fix flaws found by Anthropic's Mythos. Researchers stress AI is magnifying existing dynamics of vulnerability discovery and disclosure rather than doing anything fundamentally new.
"We'll definitely see more of these long-life bugs that are in every version of the software for the last decade or whatever," says Jake Williams, vice president of research and development at Hunter Strategy and a former NSA hacker. "But I think there's only so much of this low-hanging fruit. There isn't much else that has the specific reach of PHP. It's a pretty wild attack surface—most other tools aren't exposed to the internet by design."
Even with frontier models, most sophisticated AI-aided hacking still involves human expertise. As Ryan Austin, the Calif researcher who first found the PHP flaws, wrote this week, "No model is simply capable of unearthing 'all bugs' with simple prompts. At least for now."
Security engineer and researcher Niels Provos says everyone can dial back the alarm a bit. "To be honest, I am not really worried," he says about AI finding an overwhelming number of newly exploitable historic bugs. "People have now been looking with AI for over a year, and it required a highly skilled team to find this one. I guess we will see whether I am completely wrong, but I doubt it."
Source: Wired