Up to 70% of world’s websites at risk after AI discovers critical security flaw

Much of the internet could be vulnerable to hackers, according to the creators of the technology that powers a massive chunk of cyberspace.The creators of PHP, which powers as much as 70% of the world’s websites, said Wednesday that its system is facing a critical security problem that hackers could use to take control of any website running its software, according to the Wall Street Journal. Security researchers found the vulnerability, called PHP2Shell, using artificial intelligence. But AI could also be used by hackers to easily exploit the bug, making the development the most severe security flaw that PHP has faced in more than a decade, according to the nonprofit foundation that manages the PHP project.The problem was discovered in August, the PHP Foundation said in a press release detailing the debacle published Wednesday. Experts have been rushing to secretly fix the vulnerabilities by Thursday with security patches before it became public knowledge and hackers could breach global systems. But revelations about the bug were leaked on Tuesday, leading PHP’s managers to issue a warning to the world to be on alert and expect a critical security update on Wednesday. They described the move as “a good balance to inform defenders” while not giving “attackers too much time to develop exploits,” according to the outlet. The flaw was uncovered in August, when Calif, a security company, used one of OpenAI’s most advanced models to find the problem. The bug had been previously flagged by a security researcher decades earlier, but was dismissed at the time because it was considered too complex to exploit, according to the Wall Street Journal.But AI, which was used to uncover PHP2Shell, could also be used by hackers to swiftly exploit the bug. Researchers warned the flaw was “the most severe AI vulnerability that was ever found.”Security researchers embarked on a massive patching effort to fix the bug ahead of an Oct. 22 deadline, according to the outlet. There are close to 200 files being fixed, and developers wrote over 10,000 lines of code during the process.The PHP Foundation said it runs a large share of the web, including government services, online stores, banks, media sites, and much of the software that businesses rely on every day.META HIT WITH $25 BILLION PENALTY OVER CAMBRIDGE ANALYTICA DATA PRIVACY VIOLATIONSThe foundation said that Chainguard, a cybersecurity software company, leaked the news about the problem hours before it was set to be fully fixed. Chainguard was in the loop about the vulnerabilities because it was one of many distributors that had received the security patch in advance so its users could update the moment the vulnerabilities were disclosed to the public.“Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release,” the PHP Foundation said. “This disregarded weeks of work by many parties toward a coordinated disclosure.”