AI uncovers massive flaw in web's foundational code

Security officials have issued warnings regarding two critical vulnerabilities discovered in the widely used programming language PHP, which powers nearly 70% of the world's websites. Researchers from Wiz have stated that these flaws, uncovered in part through the use of an OpenAI model, represent some of the most severe vulnerabilities ever found in software, some of which have been present for decades.

Government officials from countries including the United States and Japan are urging companies to apply a patch to fix these issues or consider shutting down their sites as a precaution. OpenAI acknowledged the role its model played in identifying one of the vulnerabilities, which allowed researchers to create a fix. However, security experts have expressed skepticism about AI-generated vulnerability reports, as many have proven to be minor bugs or false alarms.

The PHP flaws, if exploited, could enable hackers to take control of vulnerable web servers without the need for passwords or other credentials, potentially leading to the theft of sensitive information, the takeover of websites, and tampering with online content. Some website owners have already taken their sites offline while they apply patches, including portions of Wikipedia and 4chan.

The discovery underscores the fragility of the modern internet, which heavily relies on open-source software. While AI can uncover critical security flaws, it also poses a threat by enabling attackers to rapidly develop offensive tools and exploits.