OpenAI AI uncovers PHP flaws affecting 70% of the world’s websites: What to know
AI helped uncover the flaws
PHP is built into the internet and may be used by websites without their operators realizing it, Wall Street Journal reporter Robert McMillan told CBS News. He said some sites may not know they have a problem until they are affected.
McMillan said people had noticed unusual behavior, but had not found a way to turn the bug into an exploit that could run unauthorized software. The task was complex and could take months for a person, he said, while AI can handle such lengthy work faster.
The period between finding a vulnerability and releasing a fix is important to cybersecurity teams. McMillan said AI has shortened that window, giving cybercriminals the ability to move faster than before.
Two critical PHP flaws
The report describes two critical security flaws that could let hackers take control of vulnerable website servers. Possible consequences include stealing customer information, changing site content, installing malware or taking a website offline.
Mediatech security head Voldemaras Kadys said the potential impact could be extensive because most websites run PHP. The article’s headline says 70% of the world is affected, while Kadys’s statement describes PHP as running on most websites.
What users should do
A group urged anyone running PHP to update immediately. It said php.net’s announcement includes technical details about the flaws and attack methods, along with instructions for updating on different systems.
Kadys said simply visiting a PHP website does not necessarily put a person’s device at risk. However, attackers could target a website holding personal information, such as an online shop, and potentially obtain details including a name, email address, physical address or date of birth.
Kadys said people do not need to stop browsing or shopping online. He advised extra caution around suspicious messages because it is unclear what data may have been taken or which websites may have been affected.
Key points
- Researchers used an advanced OpenAI AI model to identify a longstanding PHP vulnerability before hackers could exploit it.
- Two critical flaws could let attackers take over vulnerable servers and steal customer information or disrupt websites.
- The article’s headline cites 70%, while a security expert says most websites run PHP.
- PHP operators were urged to update; users should remain alert to suspicious messages.