AI compresses window for exploiting long-standing PHP flaws
Two remote code execution vulnerabilities in PHP, present for years, have been discovered by OpenAI and a Google-supported entity. The rapid generation of exploits by AI has drastically shortened the time between disclosure and active attacks, creating new risks for the 70% of websites running PHP.
Two security vulnerabilities in PHP, which had existed for years, were independently identified by OpenAI and a Google-supported entity. These flaws allowed for remote code execution without requiring a login. Because approximately 70% of websites run on PHP versions 5 and above, the discovery triggered a rapid patching cycle across the web. Initial reports suggested the vulnerabilities were easily exploitable, but later analysis indicated that successful attacks require sophisticated techniques, such as sending thousands of requests, rather than a single click.
Despite the technical complexity, the speed of exploitation has changed fundamentally. AI systems can now generate exploits at scale, drastically reducing the time between public disclosure and active exploitation. This acceleration creates a conflict with supply chain security, illustrated by a recent incident involving LiteLLM, where a password stealer was distributed via a security patch. Ben Thompson argued that these incidents may force the open internet to retreat behind managed, password-protected environments. Such a shift would impact self-hosting practices, including those used by platforms like Nextcloud, as organizations weigh the trade-off between rapid patching and the heightened risk of supply chain attacks.