Decades-Old Threat Suddenly Matters Thanks to AI

Folks, I almost spilled my coffee reading this one. It seems that back in July 2004, security researcher Stefan Esser sent a warning about a critical flaw in PHP, the programming language that powers 70% of the world’s websites. And get this – the flaw could allow an attacker to do some seriously nefarious stuff: read passwords, steal databases or even take over entire websites. But here’s the kicker: Esser’s warning went mostly ignored for decades. I mean, bless their hearts, it’s not like they didn’t have anything better to do.

Now, I know what you’re thinking. How could something so critical be ignored for so long? Well, it turns out that the vulnerability was just too tedious for humans to exploit. It would have taken mind-numbing work for a human to figure out how to take advantage of it: tedious, time-consuming, monotonous coding. But, as we all know, AI doesn’t get tired, and it can crack safes way faster than humans.

In 2020, another researcher discovered a related problem, and the PHP overseers issued a partial fix. A similar PHP vulnerability was uncovered in 2024 – but was left unfixed. You can’t make this stuff up, folks. It’s like they say: “security by exhaustion” is no longer a viable safeguard against bad guys.

So, what happened next? On Wednesday, OpenAI’s public revelation of the exploit was announced in conjunction with a security update to fix the problem. Phew, you might think. The good guys got to it first. But the AI-assisted discovery deeply concerned cybersecurity researchers, because the next one might come from someone who wants to weaponize it. And AI doesn’t care who’s pulling the trigger.

Now, I’m no expert, but it seems to me that the internet is held together with shoestring and bubblegum. An apt xkcd cartoon visualizes “all modern digital infrastructure” as a giant Jenga tower supported by one, thin, vertical block with the label: “a project some random person in Nebraska has been thanklessly maintaining since 2003.” Somewhere in Atlanta, a producer thought this sounded terrifying, and I have to agree.

The security community lit up social media with I-told-you-sos. “The security industry has long been warning about the coming security apocalypse, because AI can do these things very, very quickly – better than humans,” said Vyas Sekar, professor of computer engineering at Carnegie Mellon University. “This may be the first of many. This is a wakeup call.” Sekar says there are more PHP-like vulnerabilities out there to discover and exploit. A lot more. Some are known, and many are unknown.

The vulnerability was patched, but the threat may not be over, noted Adam Meyers, vice president of counter adversary at security company CrowdStrike. Many outdated versions of PHP are still in use, and the patch almost certainly didn’t fix all of PHP’s problems. Also, an apparent leak about the vulnerability before the patch was released resulted in thousands of exploits in the hours ahead of the announcement, according to security company Cloudflare.

So, what’s next? OpenAI offered several suggestions in its disclosure about the PHP patch, all of which basically boil down to: Write better, more secure code from the start. But that’s not super helpful if your web application has been written using PHP. Migrating away from PHP is a pretty expensive process, noted Meyers. It’s not like switching from Microsoft mail to Google mail; you need to rebuild the whole application.

In conclusion, this whole ordeal has been a wild ride, folks. It’s like they say: the internet is a wild west, and we’re all just trying to stay one step ahead of the bad guys. But with AI on the scene, it’s getting harder and harder to keep up. As Madhu Shashanka, cofounder of security company Concentric AI, said: “Everything is a potential vulnerability. Every business operation is a high-stakes operation.” So, let’s all just take a deep breath and hope that the good guys can keep up with the bad guys. And if all else fails, we can always just drink coffee while the AI does its thing 🤣.

Big Elephant

Armchair patriot. Believes in the free market, cold beer, and that there’s always a guy named George behind every CNN segment.

Former remote-throwing champion turned #1 couch commentator on liberal panic in the media. Born in Texas (or so his mug says), he earned a degree in Fake Newsology & Beer Philosophy from YouTube University.