AI Played Key Role in Discovering Major Internet Security Vulnerabilities

Critical security vulnerabilities in PHP, a programming language that powers an estimated 70% of websites globally, have been discovered with the significant assistance of artificial intelligence tools, prompting urgent calls for updates from government agencies and organizations worldwide.

The PHP Foundation and the FBI's cyber division issued advisories Wednesday warning of the vulnerabilities, which could allow attackers to gain unauthenticated access to websites and remotely control web servers without needing a password. This could lead to data theft, alteration of information, or the use of compromised systems for launching further attacks.

The discovery and remediation process for these flaws involved a coalition of researchers, security providers, and AI companies, including OpenAI. Researchers at the cloud security platform Wiz independently used AI to identify the vulnerabilities. This highlights the evolving landscape of cybersecurity, where AI is increasingly used both to find and exploit digital weak points.

James Sullivan, director of cyber and tech at the Royal United Services Institute in London, noted that while the dual use of AI in cybersecurity can be concerning, this instance demonstrates a positive application. "We’ve actually seen quite a decent use case here where AI can discover some critical vulnerabilities and then the community can come together to remediate them," he said.

PHP, a free and open-source language, is foundational to widely used content management systems like WordPress and Drupal, as well as MediaWiki, the software that powers Wikipedia. Its prevalence means the potential impact of the vulnerabilities is extensive.

Organizations using PHP were urged to patch the vulnerabilities or take their sites offline if immediate updates were not feasible. Some government services and websites in countries including the United Kingdom, Finland, and Japan have experienced disruptions as a result. The delay in a fix was attributed by the PHP Foundation to a "structural failure" involving the security team's decision-making process and a lack of resources, acknowledging the delay since at least 2024.

While progress on a fix was initially stalled due to challenges in finding practical solutions, the involvement of AI has accelerated the identification and response to these critical security gaps.