AI Uncovers Critical PHP Flaws After 14 Years, Sparking Cyber Race
AI models helped uncover two critical, 14-year-old vulnerabilities in PHP, sparking a race between rapid developer patches and millions of automated cyberattacks within hours.
Artificial intelligence tools have played a pivotal role in uncovering two critical vulnerabilities in PHP, the programming language powering roughly 70% of websites, which remained undetected for 14 years. According to an analysis by Enrico Chinello, a senior executive at Julius Baer, the discovery highlights how AI is transforming cybersecurity by drastically shrinking the window between vulnerability disclosure and cyberattacks.
The flaws in the PHP core engine were identified in early August by Calif, a firm specializing in AI red teaming, utilizing models provided by OpenAI as part of the "Patch the Planet" initiative. A separate security company independently discovered similar vulnerabilities weeks later using a combination of public AI models and proprietary tools. While the AI systems were instrumental in pinpointing the long-standing code defects, human oversight remained essential for reviewing and approving the final patches.
Following the emergency fixes released by the PHP Foundation, the event triggered a high-stakes race between developers patching systems and threat actors attempting exploitation. Network monitoring platforms registered millions of exploit attempts within 24 hours of disclosure, with initial probing starting just hours after the news broke. Cybersecurity research firms estimated that over 22 million instances were potentially exposed worldwide.
Chinello emphasized that AI is compressing the timeline from discovery to exploitation to mere hours, underscoring the urgent need for automated patching, robust vulnerability management, and real-time threat detection. This dynamic reinforces the structural case for investing in cybersecurity, as organizations increasingly rely on advanced defense mechanisms to counter AI-driven threats.
