The most extensive internet security threat had been known for 22 years, but artificial intelligence turned it into a serious crisis in just two days.
In July 2004, security researcher Stefan Esser warned about a critical flaw in PHP—the programming language that underpins 70% of global websites. This defect could allow an attacker to read passwords, steal databases, or completely take over websites. Nevertheless, Esser's warning was long ignored.
In 2020, another researcher discovered a related issue, and PHP developers released a partial fix. A similar vulnerability in PHP was identified in 2024 but remained unpatched. This raises the question: why did one of the most serious threats to the foundation of the internet remain unresolved for two decades?
The reason was the labor-intensive nature for humans to discover how to exploit this vulnerability; it required monotonous, time-consuming coding, making exploitation impractical.
However, AI managed to find an exploitation method in just two days. On Wednesday, OpenAI publicly disclosed the exploit along with a security update to address the issue.
Despite 'good guys' being the first to discover the vulnerability using AI, this deeply concerned cybersecurity researchers, as the next such finding could come from those intending to use the opportunity maliciously. Artificial intelligence does not distinguish who pulls the trigger.
Modern digital infrastructure is often compared to a Jenga tower supported by a thin vertical block serviced by someone randomly in Nebraska since 2003. On July 30, researchers from the AI security company Calif, in collaboration with the OpenAI initiative Patch the Planet, directed a large language model to study the PHP block, not expecting to find anything critical.
But on August 1, the model discovered an attack method for the PHP vulnerability. Within days, others were found, and later, the US-based company Wiz, supported by Google, also discovered new exploits for PHP vulnerabilities. The patch was released on Wednesday, and the companies disclosed their findings. Wiz called it one of the most serious vulnerabilities in software history.
The security community actively discussed this on social media. Professor of Computer Engineering at Carnegie Mellon University, Weiss Sekar, stated: 'The security industry has long warned about an impending security apocalypse because AI can do these things very quickly—better than humans. This could be the beginning of many. It is a wake-up call.'
Sekar notes that there are many other vulnerabilities like PHP yet to be discovered and exploited. The widespread availability of AI tools has significantly lowered the barrier to entry for hackers wishing to exploit potential weaknesses. This fact alarmed Anthropic so much that the company suspended the deployment of its Mythos model in June, as it was highly effective at identifying security vulnerabilities and attack vectors, leading the US government to classify it as a national security threat.
Nevertheless, Calif researcher Ryan Austin noted in his blog that the company did not use any specialized AI models that were not publicly available. Nick Rogers, CEO of Fieldwork AI, stated that the democratization of AI tools showed that 'security through exhaustion' is no longer a viable defense against attackers.
For 22 years, PHP functioned like a bank without guards. Anyone could approach the vault and take money if they had enough time to check every code. It was such tedious work that nobody bothered to spend time on it. But AI does not get tired and can hack safes much faster than people.
Rogers emphasized: 'Proving a theoretical (vulnerability) and showing that it can be exploited is quite tedious and mechanical work. AI can keep working until it finds a solution. You don't even have to try; you can drink coffee while it does it.'
Essentially, PHP is the engine powering most of the internet. Before it was fixed on Wednesday, it contained a fatal defect. The vulnerability allowed an attacker to interfere with how PHP processed requests to run websites. If the server crashed due to lack of memory, it left outdated data that could be used for information leakage or malicious code execution.
The exploit can be likened to a situation in a busy restaurant kitchen. Customers can overload the chef with too many complex orders, causing them to abandon the work mid-meal, leaving dirty dishes, raw ingredients, and recipes on the table. Then, when a new chef is hired, they serve contaminated food on dirty dishes and even send some recipes to customers with the order.
Although the vulnerability was long considered theoretically exploitable, figuring out how to implement it proved extremely difficult. Hackers had to force the server to crash due to memory shortage at a specific moment to bypass PHP's security restrictions. When researchers directed AI toward this problem, it quickly found several ways to bypass this restriction. One solution uses an inconsistency in how PHP measures compressed and decompressed files, effectively allowing compressed files to pass through the gate so the file unpacks itself and takes control from within. Another attack targets PHP using deeply nested file structures that overloaded PHP's directory structure, causing a memory crash.