AI-Discovered PHP Flaw Highlights New Cybersecurity Race

A significant security flaw in PHP, the programming language used by an estimated 70% of the web, was discovered with the assistance of artificial intelligence, underscoring a new era of cybersecurity where AI aids defenders in finding vulnerabilities at an unprecedented pace.

In early August, security researcher Sagi Tzadik of Wiz tasked an AI agent with examining a known WordPress flaw and assessing its potential impact on Drupal. The AI failed to find a flaw in Drupal but, in the process, identified a previously undetected weakness in PHP. Initially dismissed as a potential AI hallucination, the flaw was confirmed to be a real and exploitable vulnerability that had gone unnoticed for over a decade.

Researchers from another firm, Calif, working with OpenAI, independently used AI to uncover a related vulnerability. This dual discovery suggests that as AI capabilities advance, the identification of long-standing security weaknesses will likely increase. AI companies are attempting to give cybersecurity firms early access to these advanced models to allow them to discover and fix flaws before malicious actors can exploit them.

While the discovery has raised concerns about AI-driven cybersecurity disasters, those involved in finding the PHP flaw expressed optimism. Tzadik noted that the incident allowed for vulnerabilities to be fixed at an “unprecedented rate,” which he believes is beneficial for overall security.

However, the situation nearly escalated into a crisis. News of the vulnerabilities began circulating online two days before the planned release of a security patch. PHP maintainers accelerated the patch's release by one day. Subsequently, a video demonstrating an exploit was mistakenly posted by Calif, leading to a surge in copycat attempts. Cloudflare observed hundreds of thousands of exploitation attempts within hours of the public announcement.

Many websites, including those of government agencies and parts of Wikipedia, were taken offline as a precautionary measure while security teams worked to implement the patch. Tomer Schwartz, co-founder and CTO at Wiz, stated that the situation could have been far more severe if the vulnerability had leaked earlier, before a patch was ready.

The rapid development of the patch was the result of a collaborative effort. Wiz and Calif shared their findings with PHP developers and worked together, alongside approximately 15 other researchers from competing firms. This collaboration, driven by trust rather than formal contracts, involved daily communication to identify the root cause of the vulnerabilities and develop a solution.

This collaborative approach is expected to face increasing pressure as AI-generated discoveries multiply. OpenAI has indicated that the PHP flaws are among several significant vulnerabilities they have helped identify and are working to fix, predicting a sharp rise in similar discoveries in the coming months. This trend necessitates a reevaluation of cybersecurity processes, methodologies, and technology stacks to keep pace with potential threats.

Despite defenders receiving an early advantage by having AI help identify vulnerabilities, they face the inherent disadvantage that attackers only need to succeed once. Schwartz highlighted that defenders must ensure comprehensive coverage for every vulnerability.

AI has significantly accelerated the process of vulnerability detection. Previously, testing suspected bugs could take weeks, requiring researchers to prioritize efforts. AI agents now enable researchers to test numerous possibilities simultaneously, condensing months of traditional research into days or even hours.

However, the process remains labor-intensive. Even with AI assistance, researchers like Tzadik spent days deciphering the exact cause and reproducing the PHP bug. The cost associated with using AI for security research is also a factor, with one firm reportedly spending approximately $1 million using Anthropic's Mythos tool to identify bugs.

Adam Meyers, CrowdStrike's VP of Counter Adversary, described the current industry climate as one where robust cybersecurity is non-negotiable. He also noted that even successful exploits do not signify the end of the security narrative, but rather the beginning of a potential defense engagement.