What changed
Hackers exploited critical vulnerabilities in PHP, a widely used programming language, four days before the flaws were publicly disclosed. The vulnerabilities, discovered using AI tools, are being actively exploited in the wild, according to Amazon and the US National Security Agency (NSA).
The NSA warned that websites using PHP are critically exposed to hacking, with some European governments reportedly taking sites offline while patching the flaws.
What this means in practice
The vulnerabilities, which provide a direct path to a server’s file system or database, were identified with the help of AI models from OpenAI and Google.
The PHP developers released patches to address the flaws, and the NSA urged organizations using PHP to update their systems immediately or take them offline.
OpenAI noted that frontier AI found these vulnerabilities before attackers did, highlighting the dual-edged nature of AI in cybersecurity.
Limitations and availability
The vulnerabilities were discovered by researchers at Calif and Wiz, with Alphabet-owned Wiz estimating that PHP powers about 70 percent of all websites globally. The White House is assessing the potential impacts of the bugs on government systems and critical infrastructure.
The UK’s National Cyber Security Centre warned that the flaws could allow hackers to take control of a website’s server without needing a password or login credentials.
The affected audience includes all organizations using PHP, particularly those running WordPress-based websites, which rely heavily on the language.
