AI tools help researchers find serious PHP bugs faster than before

In short: Security researchers are using AI tools to find dangerous software bugs faster, and a recent case in PHP led to urgent fixes and some temporary shutdowns.

What's going on

Researchers using AI-assisted security checks recently uncovered two critical flaws in PHP, a programming language that powers many websites. The bugs could have allowed an attacker to run their own code on a server, even without a password (like finding a way to make a locked machine follow your instructions).

PHP’s developers released updates to fix the problems. U.S. government agencies also urged organizations to patch quickly, or temporarily take affected systems offline if they could not update right away.

The issues were found during an AI-assisted audit by researchers in California. The security company Wiz later said it found the same flaws independently using similar AI tools. Wiz also said the bugs had existed for years, but turning them into a real attack required a complicated chain of steps.

This PHP incident fits a broader pattern. VulnCheck reported that vulnerability discoveries doubled compared with the year before. Experts also pointed to newly disclosed problems in other widely used software, including Node.js and Plex, and warned that more urgent patching and short-notice outages may follow.

What to watch

Faster discovery does not automatically mean attackers are already succeeding. Some researchers say many AI-identified bugs are hard to turn into working attacks, and reports on the PHP case said there was no evidence at the time that it had been exploited. Still, the trend suggests companies may need faster routines for figuring out which systems are affected, prioritizing fixes, and installing updates before bad actors can catch up.

Source: NYTimes