From Fortune · Emily Forlini · · 3m
AI finds the bug that breaks the web
Researchers using AI discovered a critical flaw in PHP, which runs 70% of the internet. Now hackers are racing to exploit it before companies can patch.
In brief
Researchers using AI discovered a critical flaw in PHP, which runs 70% of the internet. Now hackers are racing to exploit it before companies can patch. AI models discovered a critical vulnerability in PHP affecting 70% of the web. Hackers began exploiting it before public disclosure, forcing a global race to patch…
A new era of AI hacks
More than twenty cybersecurity incidents hit in October alone. Security experts say AI models have become noticeably more powerful at exploiting code bugs and acting autonomously.
The PHP flaw heard round the world
In August, research teams using AI models found two vulnerabilities in PHP, which an estimated seventy percent of the web runs on. OpenAI's G P T five point six Sol model played a key role.
The bugs get a name
The two PHP vulnerabilities and the method for exploiting them are collectively named php two shell. The PHP foundation announced it would issue a critical patch within twenty four hours on October twentieth.
The leak before disclosure
News of the vulnerabilities and how to exploit them leaked in the days before PHP's announcement. According to Amazon Web Services, hackers started exploiting php two shell on October seventeenth, prior to public disclosure.
A dangerous window opens
A day-long gap existed between PHP announcing a patch and issuing it. After public disclosure on October twenty-first, millions of attempts to exploit the bugs followed as websites scrambled to update.
WordPress spared, services offline
WordPress, the service most affected by the bug, reports no issues. However, many governments and private entities took web services offline to protect them from attacks while waiting for patches.
OpenAI's Daybreak program grows
OpenAI's Daybreak program grants organizations access to sophisticated tools to defend against AI-powered attacks. Two weeks ago, OpenAI reported participants found eight hundred fifty-eight software flaws, now swelled to one thousand eight hundred eighty-five.
Patches produced double
The number of patches produced by Daybreak participants went from two hundred sixty-three to six hundred sixty-one. The more companies enroll, the more people use OpenAI's tools to find and patch bugs proactively.
Brockman amplifies the message
OpenAI cofounder and president Greg Brockman posted about the PHP exploit and OpenAI's role in discovering it on X, a rare lengthy post he pinned to his profile.
Building a sales machine
OpenAI hired a new chief revenue officer over the summer with a cybersecurity background and tasked him with building a sales team to pitch defensive software to companies.
New tools coming this fall
OpenAI plans to debut a new cybersecurity-focused model this fall, plus a first-of-its-kind tool to help businesses deploy it across their infrastructure more easily.
The race for defensive AI revenue
OpenAI made a proactive bet that AI-powered cybersecurity tools would become a burgeoning revenue source. That prediction is coming true. Anthropic runs Project Glasswing, and multiple other providers offer similar tools.
Cash on the line
Companies selling defensive AI cybersecurity tools could see serious revenue if the trend continues. The race is on to patch vulnerabilities before AI-powered hackers get to them first.
The main idea
AI models discovered a critical vulnerability in PHP affecting 70% of the web. Hackers began exploiting it before public disclosure, forcing a global race to patch systems.
