A decades-old PHP vulnerability forced major websites offline and exposed the growing threat of AI-powered cyberattacks
-1920x1159.jpg)
Patrick Lux/Getty Images
The essential business news, delivered fresh every morning.
Join 500,000+ readers who start their day with Quartz.
By subscribing, you agree to our Terms of Service and Privacy Policy.
Two bugs, that have been around for roughly 20 years, would have let a stranger take over a website’s server without a password. Researchers found them in August with the help of AI and spent weeks building a fix in secret. When it was released last Wednesday, agencies including the FBI and the National Security Agency warned that sites that couldn’t update right away might be better off going offline until they could.
Sites like 4chan, DeviantArt and the Internet Archive took the advice and went dark for hours or days, and government agencies in the Netherlands and Finland pulled sites as a precaution. Some older sites and games couldn’t be patched at all and shut down for good.
Then the expected wave of damage mostly didn’t arrive. Hackers tried, with millions of attempts in the first day, but largely failed because the vulnerabilities were difficult to take advantage of. Exploiting them took a chain of steps that most human experts would struggle with, even using the best tools. Non-experts with cheaper AI tools face an even bigger uphill battle. That doesn’t mean the danger passed, however. Quiet break-ins are the hardest to spot, so an intruder who got in early could still be there.
Red light ahead
The PHP scare was the loudest moment in months of escalating signals. In April, Anthropic said its Mythos Preview model could find serious flaws in every major operating system and web browser. Some of the bugs had survived more than a quarter of a century of human review.
The company held the model back from the public and gave access to only about 50 organizations. OpenAI said a similar model of its own would stay under wraps too. Some researchers questioned how big a leap it really was, but the people who maintained widely used software said the change was real.
Open-source developers noticed first. A year earlier they were buried in junk AI bug reports, and only a sliver pointed to real problems. This year most of the reports were legitimate, and one popular project fixed more vulnerabilities in three months than in either of the previous two years.
Testing showed how far the technology had come. In June, U.K. government researchers found Mythos could complete a full simulated attack from start to finish, though only three times in 10 tries. OpenAI’s latest model managed it twice.
The coming storm?
Security experts see a narrow window to prepare. Within the next six months, Chinese and open AI models could catch up with the most powerful American systems at carrying out cyberattacks, making the tools cheaper and more widely available. Attackers are already using AI to find vulnerabilities and develop exploits faster than before. As more AI-generated code enters production, the pile of software that needs securing is growing too.
The strategy is shifting too. Patching alone can’t keep up when AI can uncover vulnerabilities faster than organizations can fix them. Security teams are working to contain intruders and automate every defensive step they can. Booz Allen built a decoy system that the AI fell for more than 90% of the time. Human hackers usually saw through it.
The PHP episode suggested both camps were right. Defenders won through quiet coordination, a lucky break and attackers who couldn’t yet turn a flaw into a weapon. That last part won’t last forever.
Leave a Reply