Why AI could threaten much of the world’s digital infrastructure

The vulnerabilities were embedded in the code of PHP, a programming language that runs about 70 percent of the world's websites, for more than a decade before being discovered by independent cybersecurity experts using artificial intelligence. These flaws had gone unnoticed because they were too complicated for humans to exploit without advanced AI assistance.

Cybersecurity experts warn that PHP2Shell could be the first in a deluge of security flaws exposed by emerging AI. Much of the world's most critical digital infrastructure is maintained by volunteers who often lack the resources and time to respond to newly discovered threats at the pace AI is uncovering them.

Open-source reliance

PHP got its start in 1995 when Danish-Canadian programmer Rasmus Lerdorf created it to track visitors to his online resume. The open-source nature of PHP allowed it to grow in popularity, with websites like Facebook and Wikipedia built using it. In 2021, the PHP Foundation was launched to coordinate development, operating on a meagre budget like many other foundations maintaining open-source software.

The world's digital infrastructure heavily relies on open-source software. Mozilla Firefox, languages like Perl, Python, and JavaScript, and server software like Apache HTTP Server are all open-source. Major corporations like Meta, Google, OpenAI and Anthropic depend on this volunteer-built infrastructure.

Overwhelmed maintainers

AI models are discovering security flaws at an unprecedented rate. Google uncovered more than 1,000 security bugs in its last Chrome browser update, more than in the last two dozen updates combined. Mozilla found over 400 security vulnerabilities in April, a significant jump from the previous record of 76 bugs just one month earlier.

The PHP2Shell vulnerabilities were found through several advanced AI models that can employ far more complicated hacking attempts than humans. While AI helps find these issues, humans must still verify them, consuming enormous amounts of time and resources.

Corporate response

Anthropic launched Project Glasswing, offering $100 million in credits to support its Claude Mythos AI model to search for security vulnerabilities. In one month, more than 23,000 vulnerabilities were found across over 1,000 open-source projects. The Apache Software Foundation uses the Alpha-Omega project, backed by companies like Anthropic, Amazon, Google, Microsoft and OpenAI, which spends about $7 million annually helping find critical bugs.

Despite these efforts, maintainers say corporate involvement remains insufficient. When a major security flaw like PHP2Shell is uncovered, it often comes down to a handful of volunteers to fix it. The 2021 Log4Shell vulnerability, which allowed hackers to remotely run code on millions of devices, underscored the critical role open-source software plays in system security.

Slattery, who tracks real-world AI incidents, noted that while more vulnerabilities are being detected and addressed in time, attacks on a wide range of systems are also increasing. "We have been moving in this direction for a long time. There are more and more things now you can attack," he said.