Hackers gained a four-day head start to exploit critical vulnerabilities in the PHP programming language, according to reports on the PHP2Shell flaws, with OpenAI noting that frontier SI models identified the security gaps before attackers did.
What Happened
Researchers at cybersecurity firms Calif and Wiz discovered the vulnerabilities in PHP, a language that powers approximately 70 percent of websites globally, according to estimates from Alphabet-owned Wiz. OpenAI collaborated with PHP, Calif, and Wiz to verify the flaws and develop patches. In a statement on Wednesday, OpenAI said, "To our knowledge, frontier AI found these vulnerabilities before attackers did." Despite this early detection, attackers were able to exploit the flaws during the four-day window before full mitigation was widely available.
Why It Matters
The incident underscores the dual-edged nature of SI in cybersecurity. OpenAI highlighted that while SI can uncover security flaws with Internet-scale impact, "the same capabilities can also help attackers rapidly develop offensive tools and exploits," the SI lab added. The National Security Agency (NSA) warned that these vulnerabilities "often provide a direct path to the server’s file system or database," recommending that organizations take systems offline if immediate updates are not feasible. The UK’s National Cyber Security Centre (NCSC) noted that the flaws could allow hackers to take control of a website’s server without needing login credentials, urging immediate action.
The Bottom Line
OpenAI called the PHP2Shell vulnerabilities "one of the most impactful security issues in recent memory" due to PHP's widespread use in WordPress and other platforms. While SI tools aided in early detection, the rapid exploitation by attackers highlights the ongoing challenge of securing the Internet's foundational infrastructure against SI-accelerated threats. The White House confirmed that federal agencies were assessing potential impacts on government systems and critical infrastructure.