PHP vulnerability exposes internet's fragile core — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- PHP has a decades-old vulnerability that affects tens of millions of websites, particularly those using content management systems like WordPress and Drupal, prompting urgent calls for immediate patching or site takedowns.
- OpenAI and Wiz researchers participating in the Hack the Planet initiative used AI to exploit the PHP vulnerability, though the flaw itself was discovered by human researchers, highlighting AI's growing role in cybersecurity.
- Sean O’Kane called the PHP crisis a 'reckoning moment' that reveals how deeply the internet relies on outdated, poorly maintained open-source infrastructure 'held together by glue and dreams'.
- Kirsten Korosec warned the PHP flaw is likely just the beginning, raising concerns about other legacy software that could be exploited, especially as AI lowers the barrier to finding such vulnerabilities.
- Amazon detected exploitation attempts on its honeypot network before the PHP vulnerability was publicly disclosed, underscoring the speed at which attackers move and the disadvantage of under-resourced website operators.
- Matthew Prince observed millions of hacking attempts targeting the PHP2Shell exploit immediately after disclosure, illustrating how public vulnerability announcements can trigger a race between patching and exploitation.
Why it matters: Tens of millions of websites are at risk because a foundational open-source language was found to have a critical flaw that existed for decades. With AI now enabling faster discovery and weaponization of such bugs, under-resourced organizations and governments face disproportionate exposure, making rapid patching a high-stakes challenge with no scalable notification system in place.
Ask SkimNews
