AI-powered research turns old PHP bugs into exploitable flaws

Advanced AI models helped show that long-known errors in PHP could be exploited, exposing serious security vulnerabilities, DR reports. The flaws were first identified during a review of PHP’s code in 2024, but the timeline for disclosing them was disrupted by leaks.

The PHP Foundation said the initial review found signs of a possible problem, but researchers did not yet have a proof of concept showing how it could be exploited. Work on a fix stalled because the foundation had too few developers with the necessary expertise and too many other tasks. It has since described the delay as a “structural failure”.

Thomas Djursing, editor-in-chief of the Danish technology publication Ingeniøren, said fixing the potential flaw could have brought other problems. The decision involved weighing the costs of closing a possible vulnerability that might never be exploited against the risks of leaving it unaddressed.

The PHP Foundation later joined OpenAI’s Patch the Planet initiative, which uses advanced AI models to find and fix software bugs and security vulnerabilities. In August, cybersecurity firm Calif, a participant in the initiative, found vulnerabilities in PHP. Wiz and OpenAI found the same issues shortly afterwards, Wiz said in a blog post.

Wiz said the underlying bugs had been known for years, but demonstrating that they could be exploited had been close to beyond what human researchers could realistically achieve. Advanced AI models turned the longstanding bugs into exploitable vulnerabilities.

PHP began preparing a fix and planned to disclose the vulnerabilities publicly at 4pm Danish time on Thursday, October 22. Some organisations, government agencies and companies were informed in advance. The White House was notified on October 16, Reuters reported.

Amazon Threat Intelligence said it saw what appeared to be attempts to exploit the vulnerabilities on October 17. On the afternoon of October 20, reports about the flaws began circulating on social media. PHP then brought forward its update to October 21, saying it still needed time to package the fix and provide users with a straightforward way to update.

At about 10pm Danish time on October 20, Calif accidentally published a video showing its proof of concept. PHP said the video revealed a few additional but limited details. Although it was removed, copies soon circulated on social media.

At 9.41am Danish time on October 21, six hours before the planned release, software distributor Chainguard broke the embargo, PHP said. Distributors had received the fix in advance so users could update as soon as the vulnerabilities became public. Djursing said coordinated timing is important because publishing a fix also reveals the underlying flaw.

PHP said Chainguard’s decision disregarded weeks of work by multiple parties to coordinate the disclosure. Djursing said the company may have wanted to respond quickly to customers after seeing information about the flaws circulate.

The story then spread, and many websites in Denmark and elsewhere shut down. Denmark’s National Operational Staff, known as NOST, was activated. Wiz described the vulnerabilities as among the most serious found in PHP, and possibly in software history.

The timeline may change as more information emerges. It is not yet known who first leaked the details, and Djursing said the consequences would become clearer in the coming days as systems are checked for intruders.