0
A laptop screen displays binary code and a padlock image in Frankfurt am Main, western Germany, on Oct. 21 (local time). / AFP, Yonhap

A critical security vulnerability has been discovered in PHP (Hypertext Preprocessor), a programming language that powers up to 70 percent of websites worldwide, prompting authorities across the globe to take emergency action.

Artificial intelligence (AI) played a key role in discovering the vulnerability, but concerns are growing that AI could also be used to launch hacking attacks after information about the flaw leaked ahead of the release of a security patch.

PHP developers released new security patches on Oct. 21 (local time) to address vulnerabilities that could allow hackers to take control of certain software systems without logging in or authenticating themselves, steal information or launch cyberattacks against visitors to compromised websites, The Wall Street Journal (WSJ) reported.

As details emerged that day about PHP2Shell, a series of flaws in how PHP manages computer memory, government websites in several countries, including those in Europe, blocked access, while website operators worldwide began taking steps to protect their systems.

AI played a crucial role in identifying the vulnerabilities. On Aug. 11, Ryan Austin, a researcher at cybersecurity firm Calif, discovered a vulnerability while examining PHP source code using OpenAI's GPT-5.6 Sol and reported it to the developers. On Aug. 24, Wiz, a cybersecurity company owned by Google, also identified and reported the issue.

Researchers confirmed that hackers could exploit the vulnerabilities to execute unauthorized software on unpatched web servers in as little as a few seconds.

The patching effort was reportedly extensive. According to Reuters, PHP developers modified nearly 200 files and wrote more than 10,000 lines of code in the process.

The emergency security patches were originally scheduled for release on Oct. 22, but the rollout was moved forward by one day after information about the vulnerabilities leaked on Hacker News, an online technology community, on Oct. 20. Some hackers reportedly attempted to exploit the flaws even before the patches were released.

Government agencies and website operators said they proactively took their sites offline on Oct. 21 as reports of attempted cyberattacks began to emerge.

In a statement that day, the U.S. National Security Agency (NSA) said, "These types of vulnerabilities often provide a direct path to a server's file system or databases," advising organizations to take their systems offline to mitigate the vulnerabilities if immediate updates were not possible.

The European Commission, the European Union Agency for Cybersecurity (ENISA) and Europol also issued a joint statement recommending urgent security measures for government agencies and businesses across the region.

Experts warned that while AI can be used to identify security vulnerabilities, it could also accelerate the spread of hacking attacks that exploit them.

They noted that once security patches are released, hackers may analyze them to identify additional vulnerabilities and develop attack tools, increasing the risk of widespread damage as delays in applying the patches grow longer.

Ty Duong, CEO of Calif, the cybersecurity firm that first discovered the issue, warned, "Someone on Twitter could take the patch, analyze it with AI and post a malicious attack script. Then everything could spiral out of control."

Volker Dusch, a security engineer at the nonprofit foundation overseeing the PHP project, described the vulnerabilities as "the most serious security issue PHP has faced in a decade."

Ami Luttwak, co-founder of Wiz, said, "PHP2Shell is the most serious vulnerability discovered using AI," adding that it was so complex that it would have been difficult to discover without AI.

PHP originally stood for "Personal Home Page," but as its functionality expanded, the name came to stand for "PHP: Hypertext Preprocessor," reflecting its role as a server-side scripting language.

                                                                                                            Kim Hyun-min