AI helped find a critical security flaw affecting 70% of the internet

skynesher/E+/Getty Images

Researchers at three different companies said Wednesday that they used AI to discover and address a set of critical bugs that could affect 70% of the internet.

The vulnerabilities were uncovered by teams at OpenAI , Google-owned cybersecurity company Wiz, and another cybersecurity company, Calif . The bugs, collectively called PHP2Shell, could allow attackers to execute code and read memory that could contain sensitive information, like passwords.

AI played a crucial role in Wednesday’s discovery, allowing researchers to conduct cybersecurity work across multiple apps in just hours, the companies said. The disclosure comes after advancements in AI have raised concerns from Washington to Silicon Valley about how the technology could supercharge cyberattacks.

“With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work,” Wiz researchers wrote in a blog post on Wednesday.

Researchers at Wiz used Google’s Gemini 4 Argon, Wiz Atlas and OpenAI’s GPT-5.6 Sol during the research process. The bugs were discovered in late August but were disclosed to the public on Wednesday after PHP had a fix for it.

The PHP Foundation, the organization behind the coding language PHP that is at the center of the vulnerability, has released a patch for the bugs and is urging website operators to update their systems immediately.

The flaws could allow attackers to remotely execute code, disrupt services and expose customer data, according to web infrastructure provider Cloudflare, which has been working with the PHP Foundation, Calif, OpenAI and Wiz to address the issue.

The National Security Agency in a social media post urged organizations using PHP to update their systems, or take them offline if they’re unable to do so. The disclosure prompted some government websites in Europe to go offline as companies updated their systems, according to Reuters.

Wiz researchers say the issue is on par with the Heartbleed bug from 2014, which impacted an encryption technology estimated to be used by two-thirds of the Web. Heartbleed allowed cybercriminals to access that data that should have been protected.

Like Heartbleed, the researchers at Wiz say PHP2Shell could similarly serve as a turning point in cybersecurity. While the vulnerabilities existed for years, AI made it practical to deploy them.

“The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,” Wiz researchers wrote in a blog post. “Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.”

skynesher/E+/Getty Images

周三，三家不同公司的研究人员表示，他们利用人工智能发现了一系列可能影响 70% 互联网的严重漏洞，并着手解决这些漏洞。

这些漏洞是由 OpenAI、谷歌旗下的网络安全公司 Wiz 以及另一家网络安全公司 Calif 的团队发现的。这些漏洞统称为 PHP2Shell，攻击者可以利用它们执行代码并读取内存，其中可能包含密码等敏感信息。

两家公司表示，人工智能在周三的发现中发挥了关键作用，使研究人员能够在短短几小时内对多个应用程序进行网络安全评估。此前，人工智能的进步引发了从华盛顿到硅谷的广泛担忧，人们担心这项技术可能会极大地增强网络攻击能力。

Wiz 的研究人员周三在一篇博客文章中写道：“借助前沿人工智能模型和合适的工具，一名研究人员在一周内完成了以前世界一流团队需要数月才能完成的工作。”

Wiz 的研究人员在研究过程中使用了谷歌的 Gemini 4 Argon、Wiz Atlas 和 OpenAI 的 GPT-5.6 Sol。这些漏洞于 8 月下旬被发现，但在 PHP 修复后，于周三向公众披露。

PHP 基金会是此次漏洞的核心——编程语言 PHP 的开发机构，该基金会已发布漏洞补丁，并敦促网站运营者立即更新其系统。

据网络基础设施提供商 Cloudflare 称，这些漏洞可能允许攻击者远程执行代码、中断服务并泄露客户数据。Cloudflare 一直在与 PHP 基金会、Calif、OpenAI 和 Wiz 合作解决该问题。

美国国家安全局在社交媒体上发文，敦促使用 PHP 的机构更新系统，如果无法更新，则应将系统下线。据路透社报道，这一消息导致欧洲一些政府网站因公司更新系统而暂时关闭。

Wiz 的研究人员表示，这个问题与 2014 年的 Heartbleed 漏洞类似，该漏洞影响了一种据估计被三分之二的互联网用户使用的加密技术。Heartbleed 漏洞使得网络犯罪分子能够访问本应受到保护的数据。

与 Heartbleed 漏洞类似，Wiz 的研究人员表示，PHP2Shell 也可能成为网络安全领域的一个转折点。虽然这些漏洞存在多年，但人工智能使得利用这些漏洞成为可能。

Wiz 的研究人员在一篇博客文章中写道：“这些潜在缺陷已经存在了几十年，但要证明它们可以被利用，需要一系列极其复杂的步骤，这几乎是人类研究人员实际能力的极限。前沿人工智能模型大大降低了这一障碍，将一个长期存在的缺陷变成了可利用的漏洞。”