Website administrators around the world were urged earlier this month to install emergency updates. The warning came after the nonprofit PHP Foundation flagged critical security flaws in PHP, a widely used web programming language.
The flaws, nicknamed PHP2Shell, were found by independent cybersecurity experts using artificial intelligence. Some government and corporate websites briefly went offline to apply patches.
The vulnerabilities had been in PHP’s code for more than a decade. They went unnoticed because they would have been too complicated for humans to exploit without advanced AI.
Experts say PHP2Shell could be the first of many flaws exposed by AI. Much of the world’s critical digital infrastructure is maintained by volunteers with limited time and money.
“There’s been a lot of people in the AI safety community that said this is one of the first areas where we are going to see the harmful impact of AI,” said Peter Slattery, a research scientist at MIT’s FutureTech.
Volunteers Struggle to Keep Up
PHP started in 1995 when programmer Rasmus Lerdorf built a tool to track visits to his online resume. Today it runs about 70 percent of the world’s websites, including Facebook and Wikipedia.
The PHP Foundation was launched in 2021 to coordinate development. Like many groups maintaining open source software, it runs on a small budget.
Large companies such as Meta, Google, OpenAI and Anthropic rely on this free infrastructure. Their AI tools are now finding flaws faster than small foundations can fix them.
“It’s simply not possible with the resources in place to fix all of the known vulnerabilities,” said Amanda Brock, CEO of OpenUK, a nonprofit that supports open source software.
Other developers report similar trends. Google said it found more than 1,000 security bugs in its latest Chrome update, more than the previous two dozen updates combined.
Mozilla found more than 400 vulnerabilities in Firefox in April. The previous record was 76 bugs, set one month earlier.
“We have maybe 10 times more issues than usual because we are using AI to find them,” said Jarek Potiuk of the Apache Software Foundation’s volunteer security team. He said AI scans cost money, and humans must still review the results.
Industry Funding Efforts
Earlier this year, Anthropic launched Project Glasswing, offering $100 million in credits for its Claude Mythos model to search for software flaws. In one month, it found more than 23,000 vulnerabilities in over 1,000 open source projects.
The Alpha-Omega project, backed by Anthropic, Amazon, Google, Microsoft and OpenAI, spends about $7 million a year helping developers find critical bugs. The Apache Software Foundation has used it to scan its 290 software packages.
Potiuk said companies are “helping a lot,” but more support is needed. He suggested firms like Google or Microsoft could pay staff to spend part of their work hours maintaining open source projects they use.
Slattery said his team’s incident database shows more vulnerabilities being detected. “We are starting to see both a lot more vulnerabilities detected and addressed in time, but also attacks on a wide range of systems,” he said.
