AI-found PHP flaws spark 'Black October' hacking warnings
Security executives warn AI will expose internet flaws faster than they can be patched, after AI-assisted research found severe PHP bugs on 21 October.
The story in focus
The Guardian reports that cybersecurity leaders are warning of an AI-driven "vulnerability tsunami" after researchers used AI to find severe flaws in PHP, a language used across millions of websites. The bugs were announced 21 October, prompting urgent patching advice.
- PHP flaws found with AI assistance were announced on 21 October and may have left many websites exposed for years
- Cloudflare's Marc Prince said exploitation attempts rose from thousands before the announcement to millions after it
- The US National Security Agency advised sites running PHP to apply patches immediately
- Some government and private websites in the US and UK went offline temporarily to patch
- Wiz researchers called the flaws among the most severe discovered in PHP
What was found and when
According to The Guardian, researchers used artificial intelligence to help identify critical flaws in PHP, a coding language used across millions of websites. The vulnerabilities were announced on 21 October and may have gone unpatched for years. Some experts cited by the paper estimated that 70% of websites were at risk.
The security platform Wiz described the flaws as among the most severe found in PHP and, it argued, in software history. Wiz said the underlying weaknesses had existed for decades, but proving they could be exploited required a complex chain of steps near the limit of what human researchers could practically achieve.
Exploitation and the response
Exploitation attempts began quickly. Cloudflare chief executive Matthew Prince wrote that thousands of people tried to exploit the flaws in the 10 hours before the announcement, rising to tens of thousands within 45 minutes, hundreds of thousands within two hours and millions by the time of his post.
The US National Security Agency issued an alert urging any site running PHP to patch immediately, warning that attackers could use the flaws to access servers without authorization, steal data, disrupt services or move deeper into networks. Government and private websites in the US and UK temporarily went down to patch, The Guardian reported.
Warnings about AI
Anthropic's deputy chief information security officer, Jason Clinton, forecast a "vulnerability tsunami" in the coming months, saying there would not be enough time to patch critical infrastructure. Salesforce chief executive Marc Benioff called it a "code red", and Sam Altman said he no longer thought all bugs could be patched.
Prince said AI tools have the patience to search the internet for weaknesses and that the next two years would be fraught. The warnings remain forecasts; the PHP flaws and the exploitation figures are reported events.
How quickly did exploitation attempts rise after the PHP flaws were announced?
Cloudflare's Marc Prince said attempts went from thousands in the 10 hours before the 21 October announcement to tens of thousands within 45 minutes, hundreds of thousands within two hours and millions afterward.
Sources & further reading
- ‘Black October’: cybersecurity experts sound the alarm over new era of AI-enabled hacking ↗The Guardian
Help keep the record accurate. Send a correction.
