An interview with Ondřej Surý, a volunteer who maintains PHP and automates its patches, about his role in fixing two critical PHP security vulnerabilities

The discovery of critical PHP vulnerabilities accelerated by AI means that previously unknown security flaws can be found and exploited much faster than before.

Researchers from Wiz, Calif, and OpenAI discovered critical PHP vulnerabilities, dubbed PHP2Shell, using AI tools. These vulnerabilities, which power a significant portion of the internet, were found to be exploitable at scale, with Cloudflare observing millions of exploitation attempts shortly after public disclosure. The discovery led to widespread concern and calls for immediate patching from governments and cybersecurity experts. Several major services, including 4chan and Archive.org, were temporarily taken offline for updates. While immediate widespread exploitation has not been observed, the incident highlights the accelerated pace at which AI can find and potentially exploit software flaws. This rapid discovery and disclosure cycle, shortened by AI, presents challenges for timely deployment of patches across the internet's vast and often outdated infrastructure.

The rapid discovery of PHP2Shell vulnerabilities by AI tools, followed by a rush to exploit them, signals a fundamental shift in cybersecurity. AI's ability to brute-force the internet's vulnerabilities at scale, turning any piece of software into a potential entry point, dramatically shortens the window for defense. This accelerated cycle of bug discovery and exploit development, as demonstrated by the PHP2Shell incident, outpaces the traditional patching process for many organizations, particularly those with legacy systems.

This evolving landscape directly impacts the security posture of any entity relying on web infrastructure, potentially leading to increased cyberattacks and data breaches. The challenge now is for companies to adapt to this faster threat environment, ensuring timely patch deployment and robust security monitoring. The situation necessitates a re-evaluation of how software vulnerabilities are discovered, disclosed, and remediated in an AI-augmented world.