{"id":943349,"date":"2026-10-23T12:52:11","date_gmt":"2026-10-23T12:52:11","guid":{"rendered":"https:\/\/www.newsbeep.com\/ca\/943349\/"},"modified":"2026-10-23T12:52:11","modified_gmt":"2026-10-23T12:52:11","slug":"the-biggest-ever-internet-security-threat-has-been-known-for-22-years-ai-made-it-a-crisis-in-2-days","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/ca\/943349\/","title":{"rendered":"The biggest-ever internet security threat has been known for 22 years. AI made it a crisis in 2 days"},"content":{"rendered":"

\n In July 2004, security researcher Stefan Esser sent a warning<\/a>.\n <\/p>\n

\n A critical flaw in PHP<\/a>, the programming language that powers 70% of the world\u2019s websites, could allow an attacker to do some seriously nefarious stuff: read passwords, steal databases or even take over entire websites.\n <\/p>\n

\n But Esser\u2019s warning went mostly ignored for decades. In 2020, another researcher discovered a related problem, and the PHP overseers issued a partial fix. A similar PHP vulnerability was uncovered in 2024 \u2013 but was left unfixed.\n <\/p>\n

\n Why was one of the most severe threats to the foundation of the internet left unresolved for 22 years?\n <\/p>\n

\n Because it would have taken mind-numbing work for a human to figure out how to take advantage of it: tedious, time-consuming, monotonous coding. That rendered the PHP vulnerability impractical to exploit.\n <\/p>\n

\n AI just figured out how to do it in two days.\n <\/p>\n

\n On Wednesday, OpenAI\u2019s public revelation of the exploit was announced in conjunction with a security update to fix the problem.\n <\/p>\n

\n Phew, you might think. The good guys got to it first. But the AI-assisted discovery deeply concerned cybersecurity researchers, because the next one might come from someone who wants to weaponize it.\n <\/p>\n

\n And AI doesn\u2019t care who\u2019s pulling the trigger.\n <\/p>\n

\n The internet is held together with shoestring and bubblegum.\n <\/p>\n

\n An apt xkcd cartoon<\/a> visualizes \u201call modern digital infrastructure\u201d as a giant Jenga tower supported by one, thin, vertical block with the label: \u201ca project some random person in Nebraska has been thanklessly maintaining since 2003.\u201d\n <\/p>\n

\n On July 30, researchers at AI security company Calif, in conjunction with OpenAI\u2019s new Patch the Planet<\/a> security initiative, decided to point a large-language AI model at one of those Jenga blocks \u2013 PHP \u2013 and see what came of it. It didn\u2019t expect to find anything critical.\n <\/p>\n

\n On August 1, it found a method to attack PHP\u2019s vulnerabilities<\/a>. Days later, it found another. Then another. Later that month, Google-backed security company Wiz \u2013 another Patch the Planet participant \u2013 discovered new exploits for PHP vulnerabilities, too.\n <\/p>\n

\n The patch went out Wednesday, and the companies publicly disclosed their findings. Wiz called it<\/a> one of the most severe vulnerabilities in software history.\n <\/p>\n

\n The security community lit up social media with I-told-you-sos.\n <\/p>\n

\n \u201cThe security industry has long been warning about the coming security apocalypse, because AI can do these things very, very quickly \u2013 better than humans,\u201d said Vyas Sekar, professor of computer engineering at Carnegie Mellon University. \u201cThis may be the first of many. This is a wakeup call.\u201d\n <\/p>\n

\n Sekar says there are more PHP-like vulnerabilities out there to discover and exploit. A lot more. Some are known, and many are unknown.\n <\/p>\n

\"GettyImages-1607305270.jpg\"<\/p>\n

\n The wide availability of AI tools has significantly lowered the barrier to entry for hackers to take advantage of potential security vulnerabilities. That fact freaked out Anthropic enough that the AI company paused deployment<\/a> of its Mythos model in June, as it was so good at exposing security vulnerabilities and finding vectors for attack that the US government labeled it a national security threat.\n <\/p>\n

\n But Calif researcher Ryan Austin noted in a blog post<\/a> that the company didn\u2019t use any special AI models that weren\u2019t generally available to the public.\n <\/p>\n

\n That democratization of AI tools made clear that \u201csecurity by exhaustion\u201d is no longer a viable safeguard against bad guys, said Nick Rogers, CEO of Fieldwork AI.\n <\/p>\n

\n For 22 years, PHP was like a bank with no security guards. Anyone could walk down to the vault and make off with the cash \u2013 if they had the time to try every code. It was such arduous work, it wasn\u2019t worth anyone\u2019s time.\n <\/p>\n

\n But AI doesn\u2019t get tired. And it can crack safes way faster than humans.\n <\/p>\n

\n \u201cTaking a theoretical (vulnerability) and proving you can exploit it is quite tedious and mechanical work,\u201d said Rogers. \u201cAI can keep churning until it figures it out. You don\u2019t even need to try. You can drink coffee while it does it.\u201d\n <\/p>\n

\n Effectively, PHP is an engine that powers most of the internet. Until it was patched Wednesday, it had a fatal flaw.\n <\/p>\n

\n A vulnerability left open a patch for an attacker to mess around with the way PHP processes requests to run websites. If a server crashed because it ran out of memory, it would leave stale data behind that could be exploited to leak the data or execute bad code.\n <\/p>\n

\n Think of the exploit like taking advantage of a busy restaurant kitchen. Customers could overwhelm the chef with too many complex orders \u2013 so much that she quits midway through dinner, leaving dirty pans, raw ingredients and recipes strewn about the counter. Then, when a new chef is hired, he serves the contaminated food on filthy dishes \u2013 and even sends some recipes to customers along with their dinner orders.\n <\/p>\n

\n Although the vulnerability was long known to be theoretically exploitable, figuring out how to do it proved exceedingly difficult. Hackers had to force the server into an out-of-memory crash at a specific instant to bypass PHP\u2019s safety limits.\n <\/p>\n

\n When researchers pointed AI at the problem, it quickly found a couple ways around that. One solution exploits a mismatch between the way PHP measures compressed files and decoded files. Effectively, it allowed compressed files through its gates, letting the file unpack itself and take over from the inside.\n <\/p>\n

\n Another attacks PHP with deeply nested file structures that overwhelmed PHP\u2019s directory structure, triggering the memory failure.\n <\/p>\n

\n The vulnerability was patched, but the threat may not be over, noted Adam Meyers, vice president of counter adversary at security company CrowdStrike<\/a>. Many outdated versions of PHP are still in use, and the patch almost certainly didn\u2019t fix all of PHP\u2019s problems.\n <\/p>\n

\n Also, an apparent leak about the vulnerability before the patch was released resulted in thousands of exploits in the hours ahead of the announcement, according to security company Cloudflare<\/a>.\n <\/p>\n

\n \u201cBad guys don\u2019t need to find the vulnerability first \u2013 they can weaponize it after the fact,\u201d Meyers said. \u201cWe are still waiting to see how much of this shows up in the wild.\u201d\n <\/p>\n

\n OpenAI offered several suggestions in its disclosure about the PHP patch<\/a>, all of which basically boil down to: Write better, more secure code from the start.\n <\/p>\n

\n That\u2019s not super helpful if your web application has been written using PHP.\n <\/p>\n

\n \u201cMigrating away from PHP is a pretty expensive process,\u201d noted Meyers. \u201cIt\u2019s not like switching from Microsoft mail to Google mail; you need to rebuild the whole application.\u201d\n <\/p>\n

\n If the solution isn\u2019t to migrate 70% of the web to a new programming language, then fixing its underlying problems \u2013 and all the other software problems in the world \u2013 would hardly be an easy fix, either.\n <\/p>\n

\n What\u2019s needed, then, may be a paradigm shift in the way the security community operates. Effectively, assume everything poses a security risk.\n <\/p>\n

\n Companies need to treat every single business operation like air traffic controllers treat their surroundings, said Madhu Shashanka, cofounder of security company Concentric AI.\n <\/p>\n

\n \u201cEverything is a potential vulnerability,\u201d Shashanka said. \u201cEvery business operation is a high-stakes operation.\u201d\n <\/p>\n

\n For example, companies that leave certain software unpatched \u2013 even for a few days \u2013 are exposing themselves to vulnerabilities that are no longer too difficult or expensive for bad actors to exploit.\n <\/p>\n

\n \u201cLots of vulnerabilities are out there that are never exploited because it takes effort,\u201d said Shashanka. \u201cAI has rendered that effort meaningless.\u201d\n <\/p>\n","protected":false},"excerpt":{"rendered":"In July 2004, security researcher Stefan Esser sent a warning. A critical flaw in PHP, the programming language…\n","protected":false},"author":2,"featured_media":943350,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[62,276,277,49,48,61],"class_list":["post-943349","post","type-post","status-publish","format-standard","has-post-thumbnail","category-artificial-intelligence","tag-ai","tag-artificial-intelligence","tag-artificialintelligence","tag-ca","tag-canada","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/943349","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/comments?post=943349"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/943349\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media\/943350"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media?parent=943349"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/categories?post=943349"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/tags?post=943349"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}