AI-Powered Exploits Expose Decades-Old PHP Vulnerabilities
A pair of critical vulnerabilities in PHP, the scripting language driving nearly 70 percent of the web, forced major platforms from Wikipedia to Pokémon Home into emergency downtime. Security researchers warn that while these flaws have existed for twenty years, AI tools have suddenly made them trivial to weaponize.
The scale of the disruption reflects PHP’s ubiquity, as government agencies in Finland and the Netherlands joined private entities in pulling systems offline. The NSA and the UK’s National Cyber Security Center issued urgent guidance, recommending that administrators disconnect vulnerable servers if immediate patching proves impossible. This reaction follows the discovery that what was once a theoretical, near-impossible exploit has been rendered practical through modern machine learning.
Security firm Wiz noted that the vulnerability required an exceptionally complex chain of actions, placing it beyond the reach of traditional human researchers for two decades. AI models bridged that gap, turning an obscure bug into a reliable mechanism for remote code execution. With roughly 3.8 million sites currently running exposed PHP instances, the incident highlights a transition in cyber warfare where automated intelligence accelerates the weaponization of long-dormant code flaws.
Comments (0)
No comments yet. Be the first!