AI-discovered PHP flaws expose risks to volunteer-run internet infrastructure
Emergency patches were urged for PHP2Shell flaws found by AI, highlighting underfunded volunteer maintenance of critical web infrastructure.
At a glance
- AI tools discovered critical PHP2Shell flaws hidden in web programming code for over a decade.
- Volunteer-run open-source foundations lack the resources to patch AI-found vulnerabilities quickly.
- Google, Mozilla and Apache report sharp increases in security bugs detected using AI models.
What happened
Authorities worldwide urged website administrators to run emergency updates earlier this month after critical security flaws nicknamed PHP2Shell were found in PHP, a programming language used on about 70 percent of the world’s websites. Independent cybersecurity experts discovered the flaws using artificial intelligence. The vulnerabilities had existed in PHP code for more than a decade but went unnoticed because they were too complex for humans to exploit without advanced AI.
What we know
PHP2Shell is one of several security flaws recently uncovered by AI models scanning open-source code. Google said it found more than 1,000 security bugs in the last Chrome update, more than in the previous two dozen combined. Mozilla reported more than 400 vulnerabilities in April, up from a prior monthly record of 76. Anthropic said its Project Glasswing found more than 23,000 vulnerabilities across over 1,000 open-source projects in one month.
Much of the internet runs on open-source software maintained by volunteers with limited budgets. The PHP Foundation, launched in 2021, coordinates PHP development with meagre resources. The Apache Software Foundation maintains 290 software packages and relies on volunteer security workers.
“AI helps to find them, but you have to verify things,” said Jarek Potiuk of the Apache Software Foundation.
Experts warn that AI is accelerating vulnerability discovery faster than underfunded foundations can patch them. Peter Slattery of MIT’s FutureTech said his team’s incident database shows more vulnerabilities are being detected, and it is only a matter of time before some are exploited in the real world.
What is not known yet
It is not clear whether PHP2Shell has already been exploited by malicious hackers. The sources do not say how many websites applied the emergency updates or how long the patching process will take.
What happens next
Cybersecurity experts say major corporations that depend on open-source software should do more to fund maintenance. Potiuk suggested companies like Google or Microsoft could pay staff to dedicate work hours to maintaining open-source projects they use. Without more resources, foundations may struggle to keep pace with AI-driven vulnerability discovery.
Sources: Al Jazeera.
Questions and answers
- What is PHP2Shell?
- PHP2Shell is a nickname for critical security flaws in the PHP programming language, discovered using AI and present for over a decade.
- Who maintains the PHP programming language?
- The PHP Foundation, a nonprofit launched in 2021, coordinates PHP development with volunteer support and a meagre budget.
- How are tech companies helping open-source security?
- Anthropic, Google, Microsoft and others fund projects like Alpha-Omega and Project Glasswing to scan for bugs, but experts say more support is needed.
