PHP: OpenAI Helped Uncover Two Critical Vulnerabilities

Key Takeaways

1Two critical PHP vulnerabilities have led to urgent maintenance and the unavailability of websites, including some government sites.

2OpenAI claims that its models helped identify them, with Wiz also discovering them.

3A patch has been released, agencies have recommended preventive shutdowns, and OpenAI has released a tool to check the exposure of websites.

Why it matters : PHP powers about 70% of websites, making these vulnerabilities have a major impact on web security.

Two major vulnerabilities in PHP have led to emergency maintenance, resulting in the unavailability of public websites. OpenAI states that its models contributed to their discovery, with Wiz also identifying them. Authorities have recommended preventive shutdowns, and OpenAI expects an increase in such discoveries in the coming months.

Emerging Attacks and Shutdown Guidelines

Before the release of the PHP patch, the Chief Technology Officer of Cloudflare reported the emergence of the first attacks and the updating of mitigation measures in response to new vectors. Several cybersecurity agencies, including those from the European Union, recommended disconnecting affected sites when an immediate update was not possible following the patch release. The disruptions were significant, with maintenance making important sites inaccessible, including government services, amid a widespread alert.

AI-Assisted Discovery and Claimed Advancement

The vulnerabilities in PHP were identified with the help of artificial intelligence. OpenAI indicates that its models participated in their discovery, while Wiz also found them independently. This involvement is part of the Patch the Planet initiative, in which OpenAI has supported researchers in uncovering critical flaws. According to OpenAI, a cutting-edge AI identified these vulnerabilities before attackers, allowing maintenance personnel and security providers to prepare patches and protections ahead of disclosure.

Le brief IA que lisent les pros

Le brief IA que les pros lisent chaque soir

Les 7 actus IA du jour, décryptées en 5 min. Gratuit.

Inclus dès l'inscription : notre sélection des meilleurs guides & comparatifs IA.

Choisissez votre rythme

Gratuit · Pas de spam · Désabonnement en 1 clic

Patch Released and Verification Tool Deployed

The PHP developer released a patch addressing two critical vulnerabilities, forcing many publishers to undertake urgent updates or, if not possible, temporarily shut down access to their services. Following this release, OpenAI made available a "skill" on Codex to determine if a site is affected. These measures were taken in response to two vulnerabilities deemed serious.

A Ubiquitous Language and New Discoveries Expected

PHP powers approximately 70% of websites, which amplifies the impact of any critical vulnerability targeting it. OpenAI reports having coordinated, over the past two months, a coalition of maintainers and researchers around this work. The company anticipates that other vulnerabilities of comparable severity will be discovered and expects a significant increase in these identifications in the coming months. These events occurred while technical teams, notably at Orange, were resolving a mobile network outage.