The biggest-ever internet security threat has been known for 22 years. AI made it a crisis in 2 days - CNN

In July 2004, security researcher Stefan Esser warned about a critical flaw in PHP, the programming language that powers 70% of the world's websites. The vulnerability could allow attackers to read passwords, steal databases, or take over entire websites. Yet this severe threat remained unresolved for 22 years because exploiting it would have required tedious, time-consuming coding work that made it impractical for humans to take advantage of.

That changed when AI figured out how to exploit the vulnerability in just two days. On Wednesday, OpenAI announced its discovery alongside a security patch to fix the problem. While the quick resolution might seem reassuring, the AI-assisted discovery has deeply concerned cybersecurity researchers, as the next exploit might come from those looking to weaponize it.

AI's Rapid Discovery

On July 30, researchers at AI security company Calif, working with OpenAI's Patch the Planet initiative, pointed a large-language AI model at PHP's vulnerabilities. By August 1, the AI had found methods to attack PHP's vulnerabilities. Days later, it discovered additional exploits. Google-backed Wiz, another Patch the Planet participant, also found new PHP exploits that month.

Democratized Threats

The wide availability of AI tools has significantly lowered the barrier to entry for hackers. Calif researcher Ryan Austin noted that they didn't use any special AI models beyond what's generally available to the public. This democratization has made "security by exhaustion" no longer viable, according to Nick Rogers, CEO of Fieldwork AI.

For 22 years, PHP was like a bank with no security guards – theoretically accessible but too time-consuming to exploit. AI doesn't get tired and can crack systems much faster than humans.

Patch and Peril

The vulnerability allowed attackers to exploit how PHP processes requests to run websites, particularly when servers crashed due to memory shortages. The AI found multiple methods to bypass PHP's safety limits, including exploiting mismatches in file measurements and using deeply nested file structures to trigger memory failures.

Wiz called it one of the most severe vulnerabilities in software history. However, the threat isn't over, as Adam Meyers of CrowdStrike noted that many outdated PHP versions remain in use, and the patch likely didn't fix all of PHP's problems. An apparent leak before the patch release resulted in thousands of exploits according to Cloudflare.

New Security Paradigm

OpenAI suggested writing better, more secure code from the start, but migrating away from PHP would be extremely expensive since it powers most of the internet. Instead, Madhu Shashanka of Concentric AI advocates for treating every business operation as a potential vulnerability, like air traffic controllers approach their surroundings.

Companies must now assume everything poses a security risk, as AI has rendered the effort barrier for exploiting vulnerabilities meaningless. The discovery signals a fundamental shift in cybersecurity, where the assumption must be that every system is vulnerable until proven otherwise.