The biggest-ever internet security threat has been known for 22 years. AI made it a crisis in 2 days

In July 2004, security researcher Stefan Esser warned about a critical flaw in PHP, the programming language used by 70% of the world's websites. This flaw could allow an attacker to access passwords, steal databases, or even take control of entire websites. However, Esser's warning was largely ignored for two decades. In 2020, another researcher discovered a related issue, and PHP developers issued a partial fix.

Despite this, a similar PHP vulnerability was uncovered in 2024, but it remained unaddressed. The question arises as to why such a significant threat to the internet's foundation was left unresolved for 22 years. The reason is that it would have taken an enormous amount of time and effort for a human to exploit the vulnerability, making it impractical.

However, this changed when OpenAI publicly announced an AI-assisted discovery of the exploit in just two days. This AI discovery has raised concerns among cybersecurity experts, as it could potentially be weaponized by malicious actors. The internet is held together by a fragile infrastructure, and AI has made it easier to discover and exploit vulnerabilities.

Researchers at AI security company Calif, in collaboration with OpenAI's Patch the Planet security initiative, used AI to identify multiple exploits in PHP vulnerabilities. This incident highlights the potential dangers of AI in the cybersecurity landscape, as it can quickly identify and exploit vulnerabilities that would take humans much longer to discover.