The biggest-ever internet security threat has been known for 22 years. AI made it a crisis in 2 days

Andrew Brookes/Image Source/Getty Images

In July 2004, security researcher Stefan Esser sent a warning .

A critical flaw in PHP , the programming language that powers 70% of the world’s websites, could allow an attacker to do some seriously nefarious stuff: read passwords, steal databases or even take over entire websites.

But Esser’s warning went mostly ignored for decades. In 2020, another researcher discovered a related problem, and the PHP overseers issued a partial fix. A similar PHP vulnerability was uncovered in 2024 – but was left unfixed.

Why was one of the most severe threats to the foundation of the internet left unresolved for 22 years?

Because it would have taken mind-numbing work for a human to figure out how to take advantage of it: tedious, time-consuming, monotonous coding. That rendered the PHP vulnerability impractical to exploit.

AI just figured out how to do it in two days.

On Wednesday, OpenAI’s public revelation of the exploit was announced in conjunction with a security update to fix the problem.

Phew, you might think. The good guys got to it first. But the AI-assisted discovery deeply concerned cybersecurity researchers, because the next one might come from someone who wants to weaponize it.

And AI doesn’t care who’s pulling the trigger.

The internet is held together with shoestring and bubblegum.

An apt xkcd cartoon visualizes “all modern digital infrastructure” as a giant Jenga tower supported by one, thin, vertical block with the label: “a project some random person in Nebraska has been thanklessly maintaining since 2003.”

On July 30, researchers at AI security company Calif, in conjunction with OpenAI’s new Patch the Planet security initiative, decided to point a large-language AI model at one of those Jenga blocks – PHP – and see what came of it. It didn’t expect to find anything critical.

On August 1, it found a method to attack PHP’s vulnerabilities . Days later, it found another. Then another. Later that month, Google-backed security company Wiz – another Patch the Planet participant – discovered new exploits for PHP vulnerabilities, too.

The patch went out Wednesday, and the companies publicly disclosed their findings. Wiz called it one of the most severe vulnerabilities in software history.

The security community lit up social media with I-told-you-sos.

“The security industry has long been warning about the coming security apocalypse, because AI can do these things very, very quickly – better than humans,” said Vyas Sekar, professor of computer engineering at Carnegie Mellon University. “This may be the first of many. This is a wakeup call.”

Sekar says there are more PHP-like vulnerabilities out there to discover and exploit. A lot more. Some are known, and many are unknown.

Master/Moment RF/Getty Images

The wide availability of AI tools has significantly lowered the barrier to entry for hackers to take advantage of potential security vulnerabilities. That fact freaked out Anthropic enough that the AI company paused deployment of its Mythos model in June, as it was so good at exposing security vulnerabilities and finding vectors for attack that the US government labeled it a national security threat.

But Calif researcher Ryan Austin noted in a blog post that the company didn’t use any special AI models that weren’t generally available to the public.

That democratization of AI tools made clear that “security by exhaustion” is no longer a viable safeguard against bad guys, said Nick Rogers, CEO of Fieldwork AI.

For 22 years, PHP was like a bank with no security guards. Anyone could walk down to the vault and make off with the cash – if they had the time to try every code. It was such arduous work, it wasn’t worth anyone’s time.

But AI doesn’t get tired. And it can crack safes way faster than humans.

“Taking a theoretical (vulnerability) and proving you can exploit it is quite tedious and mechanical work,” said Rogers. “AI can keep churning until it figures it out. You don’t even need to try. You can drink coffee while it does it.”

Effectively, PHP is an engine that powers most of the internet. Until it was patched Wednesday, it had a fatal flaw.

A vulnerability left open a patch for an attacker to mess around with the way PHP processes requests to run websites. If a server crashed because it ran out of memory, it would leave stale data behind that could be exploited to leak the data or execute bad code.

Think of the exploit like taking advantage of a busy restaurant kitchen. Customers could overwhelm the chef with too many complex orders – so much that she quits midway through dinner, leaving dirty pans, raw ingredients and recipes strewn about the counter. Then, when a new chef is hired, he serves the contaminated food on filthy dishes – and even sends some recipes to customers along with their dinner orders.

Although the vulnerability was long known to be theoretically exploitable, figuring out how to do it proved exceedingly difficult. Hackers had to force the server into an out-of-memory crash at a specific instant to bypass PHP’s safety limits.

When researchers pointed AI at the problem, it quickly found a couple ways around that. One solution exploits a mismatch between the way PHP measures compressed files and decoded files. Effectively, it allowed compressed files through its gates, letting the file unpack itself and take over from the inside.

Another attacks PHP with deeply nested file structures that overwhelmed PHP’s directory structure, triggering the memory failure.

The vulnerability was patched, but the threat may not be over, noted Adam Meyers, vice president of counter adversary at security company CrowdStrike . Many outdated versions of PHP are still in use, and the patch almost certainly didn’t fix all of PHP’s problems.

Also, an apparent leak about the vulnerability before the patch was released resulted in thousands of exploits in the hours ahead of the announcement, according to security company Cloudflare .

“Bad guys don’t need to find the vulnerability first – they can weaponize it after the fact,” Meyers said. “We are still waiting to see how much of this shows up in the wild.”

OpenAI offered several suggestions in its disclosure about the PHP patch , all of which basically boil down to: Write better, more secure code from the start.

That’s not super helpful if your web application has been written using PHP.

“Migrating away from PHP is a pretty expensive process,” noted Meyers. “It’s not like switching from Microsoft mail to Google mail; you need to rebuild the whole application.”

If the solution isn’t to migrate 70% of the web to a new programming language, then fixing its underlying problems – and all the other software problems in the world – would hardly be an easy fix, either.

What’s needed, then, may be a paradigm shift in the way the security community operates. Effectively, assume everything poses a security risk.

Companies need to treat every single business operation like air traffic controllers treat their surroundings, said Madhu Shashanka, cofounder of security company Concentric AI.

“Everything is a potential vulnerability,” Shashanka said. “Every business operation is a high-stakes operation.”

For example, companies that leave certain software unpatched – even for a few days – are exposing themselves to vulnerabilities that are no longer too difficult or expensive for bad actors to exploit.

“Lots of vulnerabilities are out there that are never exploited because it takes effort,” said Shashanka. “AI has rendered that effort meaningless.”

Andrew Brookes/图片来源/Getty Images

2004 年 7 月，安全研究员 Stefan Esser 发出警告。

PHP（全球 70% 的网站都使用这种编程语言）存在一个严重缺陷，攻击者可以利用该缺陷进行一些非常邪恶的事情：读取密码、窃取数据库，甚至接管整个网站。

但埃塞尔的警告在之后的几十年里几乎无人理会。2020年，另一位研究人员发现了一个相关问题，PHP 的维护者发布了一个部分修复程序。2024年，又发现了一个类似的 PHP 漏洞，但仍然没有修复。

为什么对互联网基础构成最严重威胁的问题之一，竟然22年来都没有得到解决？

因为要让人类弄清楚如何利用这个漏洞，需要付出极其艰辛的努力：繁琐、耗时、单调的编码工作。这使得利用 PHP 漏洞变得不切实际。

人工智能只用了两天时间就掌握了这项技术。

周三，OpenAI 公开披露了这一漏洞，同时发布了安全更新来修复该问题。

你可能会想：呼，还好，好人抢先一步。但人工智能辅助发现这一漏洞令网络安全研究人员深感担忧，因为下一个漏洞可能来自那些想将其武器化的人。

人工智能并不关心是谁扣动了扳机。

互联网就像是用鞋带和泡泡糖勉强拼凑起来的。

一幅恰如其分的 xkcd 漫画将“所有现代数字基础设施”形象化为一座巨大的叠叠乐塔，由一个细长的垂直方块支撑，方块上写着：“这是内布拉斯加州某个不知名的人自 2003 年以来一直在默默维护的项目。”

7月30日，人工智能安全公司Calif的研究人员与OpenAI新推出的“修补地球”（Patch the Planet）安全计划合作，决定用一个大型语言人工智能模型来分析PHP——这块“积木”中的一块——看看会发现什么。他们原本并不指望能发现什么关键问题。

8月1日，它发现了一种攻击PHP漏洞的方法。几天后，它又发现了另一种。随后又发现了一种。当月晚些时候，谷歌支持的安全公司Wiz（也是“修补星球”项目的参与者）也发现了PHP漏洞的新利用方法。

补丁于周三发布，两家公司也公开披露了他们的调查结果。Wiz 称其为软件史上最严重的漏洞之一。

安全界人士在社交媒体上纷纷表示“我早就告诉过你们了”。

卡内基梅隆大学计算机工程教授维亚斯·塞卡尔表示：“安全行业长期以来一直在警告即将到来的安全危机，因为人工智能可以非常非常快地完成这些事情——而且比人类做得更好。这或许只是众多危机的开端。这是一个警钟。”

Sekar表示，还有更多类似PHP的漏洞有待发现和利用。数量远不止这些。有些已被发现，但还有很多未知。

Master/Moment RF/Getty Images

人工智能工具的广泛应用大大降低了黑客利用潜在安全漏洞的门槛。这一事实令Anthropic公司极为担忧，以至于该公司在6月份暂停了其Mythos模型的部署。Mythos模型在发现安全漏洞和寻找攻击途径方面表现过于出色，以至于美国政府将其列为国家安全威胁。

但加州研究员瑞安·奥斯汀在一篇博客文章中指出，该公司并没有使用任何公众通常无法获得的特殊人工智能模型。

Fieldwork AI 的首席执行官 Nick Rogers 表示，人工智能工具的普及化清楚地表明，“耗尽式安全”不再是抵御坏人的可行保障。

22年来，PHP就像一家没有保安的银行。任何人都可以走到金库前，把钱拿走——只要他们有时间把每一段代码都试一遍。这项工作如此艰辛，根本不值得任何人浪费时间。

但人工智能不会疲倦。而且它破解保险箱的速度比人类快得多。

罗杰斯说：“从理论上找出漏洞并证明其可利用性是一项相当繁琐且机械的工作。人工智能可以不断运行直到找到漏洞为止。你甚至不需要费力。你可以一边喝咖啡一边让它完成这项工作。”

实际上，PHP 是驱动互联网大部分功能的引擎。在周三修复之前，它存在一个致命缺陷。

一个漏洞留下了一个未修复的补丁，攻击者可以利用该补丁篡改 PHP 处理网站请求的方式。如果服务器因内存耗尽而崩溃，就会留下过时的数据，这些数据可能被利用来泄露数据或执行恶意代码。

想象一下，这就像趁着餐厅厨房生意火爆的时候下手。顾客们可能会用太多复杂的订单压垮厨师，以至于她中途就不得不辞职，留下脏兮兮的锅碗瓢盆、生食材和菜谱散落在柜台上。然后，当新来的厨师上门后，他会用脏兮兮的盘子盛放这些被污染的食物，甚至还会把菜谱和顾客的订单一起寄给他们。

尽管人们早就知道这个漏洞在理论上是可以被利用的，但真正找到利用方法却极其困难。黑客必须在特定时刻强制服务器内存溢出崩溃，才能绕过 PHP 的安全限制。

当研究人员利用人工智能解决这个问题时，它很快就找到了几种解决方法。其中一种方案利用了 PHP 处理压缩文件和解码文件的方式不一致。实际上，它允许压缩文件通过其“关卡”，让文件自行解压缩并从内部接管控制权。

另一种攻击方式是利用深度嵌套的文件结构攻击 PHP，这种结构会压垮 PHP 的目录结构，从而引发内存故障。

安全公司 CrowdStrike 的反作弊副总裁 Adam Meyers 指出，虽然漏洞已被修复，但威胁可能并未解除。许多过时的 PHP 版本仍在被使用，而且该补丁几乎肯定没有解决 PHP 的所有问题。

此外，据安全公司 Cloudflare 称，在补丁发布之前，有关该漏洞的明显泄露导致在公告发布前的几个小时内出现了数千次攻击。

“坏人不需要先找到漏洞——他们事后就可以利用它，”迈尔斯说。“我们仍在观察这种漏洞在实际应用中究竟有多普遍。”

OpenAI 在披露有关 PHP 补丁的信息时提出了几项建议，所有这些建议基本上都归结为：从一开始就编写更好、更安全的代码。

如果你的Web应用程序是用PHP编写的，那么这样做帮助不大。

“从 PHP 迁移过来是一个相当昂贵的过程，”梅耶斯指出。“这不像从微软邮箱切换到谷歌邮箱；你需要重建整个应用程序。”

如果解决方案不是将 70% 的网络迁移到新的编程语言，那么修复其根本问题——以及世界上所有其他软件问题——也绝非易事。

因此，安全界或许需要一种全新的运作模式。实际上，就是要假设一切都存在安全风险。

安全公司 Concentric AI 的联合创始人 Madhu Shashanka 表示，公司需要像空中交通管制员对待周围环境一样对待每一项业务运营。

“一切都存在潜在的安全隐患，”沙尚卡说。“每一项商业运营都是高风险的。”

例如，一些公司如果让某些软件不打补丁——哪怕只是几天——也会让自己面临漏洞风险，而这些漏洞对于不法分子来说利用起来并不难，成本也不高。

“很多漏洞从未被利用，因为需要付出努力，”沙尚卡说。“人工智能使得这种努力变得毫无意义。”