How AI Could Threaten Much of the World’s Digital Infrastructure

A flaw in widely used PHP

Earlier this month, authorities around the world called on website administrators to apply urgent updates after a nonprofit programming foundation identified serious security flaws. The vulnerabilities were in PHP, an open-source language used to build websites.

The flaws had been present in the code for more than a decade. They went undetected because exploiting them was too difficult for people without advanced AI capabilities, the article reports.

PHP began in 1995, when programmer Rasmus Lerdorf created software to track visits to his online resume. Developers later contributed improvements, and the language became widely adopted. Facebook and Wikipedia were built using PHP, which runs about 70 percent of websites worldwide.

Open source underpins daily technology

Open-source software supports much of the digital infrastructure people use. Examples include the Mozilla Firefox browser and programming languages such as Perl, Python and JavaScript. Many internet servers also use Apache HTTP Server, maintained by the Apache Software Foundation.

Major companies including Meta, Google, OpenAI and Anthropic depend on infrastructure built and maintained by open-source communities. Their AI tools are now finding flaws faster, creating more work for groups such as the PHP Foundation.

Peter Slattery, a research scientist at MIT’s FutureTech, said AI’s harmful effects had been anticipated by members of the AI safety community. He studies how cybersecurity experts respond to the technology and tracks real-world AI incidents.

More flaws, limited capacity

Security teams working on other software also report finding more flaws as AI is used to probe defences. Jarek Potiuk, a volunteer on the Apache Software Foundation’s security team, said the group was seeing about 10 times its usual number of issues because of AI-assisted discovery.

Potiuk described an industry-wide push to use AI models to scan for vulnerabilities. The scans cost money for AI-model tokens, and people must review the results to remove false positives.

Anthropic launched Project Glasswing earlier this year, offering $100 million in credits for its Claude Mythos model to search critical software. In one month, it found more than 23,000 vulnerabilities across over 1,000 open-source projects.

Who fixes the vulnerabilities

People responsible for finding and fixing flaws say companies could contribute more, given the value of businesses that rely on free software. When a major issue such as PHP2Shell is revealed, a small number of volunteers may be left to handle repairs.

Potiuk said internet-connected cars, microwaves and other devices became vulnerable. A malicious hacker exploiting a flaw before devices could be patched might cause major disruption. Slattery said both vulnerability discoveries and attacks on a wide range of systems were increasing. He added that the trend had been developing for a long time as more systems became potential targets.