Vulnerability has existed for more than 10 years, AI helps clarify - PHP problem

[Silicon Valley Current Affairs] The vulnerability of the programming language "PHP" has threatened about 70% of the world's websites. According to one of the companies that discovered the vulnerability, the vulnerability has existed for more than a decade but was overlooked until now. Artificial intelligence (AI) helped clarify the issue.

The two vulnerabilities in question were reported one after another to the PHP development team in August of this year. Although the team had identified signs of a problem in an external audit conducted in 2024, they had not discovered a specific method of abuse at that time and there was a lack of personnel, so action was postponed.

Researchers at security firm Caliph, who first reported the vulnerability, took a hint from a memory bug discovered in 2004 and used AI as their ``partner'' to investigate whether similar problems existed elsewhere. The model used was the high-performance AI model ``GPT5.6 Sol'' developed by OpenAI in the US. Models that are not available to the general public, such as Claude Mythos from American Anthropic, are said to have been ``never used.''

Separately from Caliph, the team at Wiz, a US company owned by Google, discovered vulnerabilities using Google's cutting-edge AI model Gemini 4 Argon. According to Wiz, the problem "has remained unresolved and unaddressed for over 10 years." Demonstrating the exploit method required an extremely complicated procedure, but the advanced AI model has significantly reduced the effort.

The PHP development team was scheduled to release a modified version of the program on the 22nd of this month, but two days before that, information about the vulnerability was leaked online. Although the team brought forward the release date to the 21st, there remained a risk that an attacker could use the information to get ahead of the public and launch a cyber attack. In fact, Amazon.com said it detected attempted attacks on the 17th and 21st.

With the advent of AI, the environment surrounding cybersecurity has completely changed. OpenAI, which reported the issue separately from the two companies, warned, ``We expect to see a rapid increase in similar discoveries in the coming months.''