The biggest-ever internet security threat has been known for 22 years. AI made it a crisis in 2 days
A long-standing security vulnerability in the PHP programming language, which was previously considered too tedious for humans to exploit, was identified and patched by AI in just two days. This discovery highlights the dual-use nature of AI in cybersecurity, where it can both protect and threaten digital infrastructure.
Why it matters
The ability of AI to automate complex exploit discovery significantly lowers the barrier for cyberattacks, posing a major risk to global web infrastructure.
In July 2004, security researcher Stefan Esser sent a warning. A critical flaw in PHP, the programming language that powers 70% of the world’s websites, could allow an attacker to do some seriously nefarious stuff: read passwords, steal databases or even take over entire websites. But Esser’s warning went mostly ignored for decades. In 2020, another researcher discovered a related problem, and the PHP overseers issued a partial fix. A similar PHP vulnerability was uncovered in 2024 – but was left unfixed. Why was one of the most severe threats to the foundation of the internet left unresolved for 22 years? Because it would have taken mind-numbing work for a human to figure out how to take advantage of it: tedious, time-consuming, monotonous coding. That rendered the PHP vulnerability impractical to exploit. AI just figured out how to do it in two days.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in