PHP vulnerabilities found with AI help spark global patching race

BBC Technology editor Zoe Kleinman reports that critical vulnerabilities in the PHP programming language, discovered with the help of artificial intelligence, have triggered a global scramble to patch millions of websites before attackers can exploit them. The flaws had existed for years but were difficult for humans to exploit; AI tools changed that calculus, enabling researchers to find and report them.

The PHP Foundation, which oversees the language, developed a fix and planned a coordinated disclosure to give site owners time to apply it. However, the news leaked, starting a race between defenders and potential attackers. As of publication, no successful attacks have been confirmed, but security firms Cloudflare and Palo Alto Networks say they have detected millions of exploitation attempts.

A key complication: the patch only works on the latest version of PHP. Sites running older versions must upgrade first, a process that can be a significant repair job for many organisations. Cyber authorities are urging immediate action.

Experts are divided on the episode. Professor Alan Woodward of Surrey University highlighted the disclosure dilemma: alerting defenders simultaneously warns attackers. Professor Gina Neff of Queen Mary University called it a success story, noting that AI-assisted researchers collaborated for months to find, fix and deploy the solution. She argued it demonstrates the capacity to manage such risks.

The episode follows an open letter from 100 technology companies less than two months ago urging greater cyber resilience in the age of AI. Kleinman notes that the same AI tools helping defenders are also available to malicious actors, who are likely already attempting to weaponise the vulnerabilities.

Source: BBC Technology.