AI-found flaws put the world's digital infrastructure under pressure, with PHP's ‘PHP2Shell’ as a warning

Volunteer-led PHP, the programming language behind most of the world's websites, is increasingly under threat from cyberattacks using artificial intelligence capabilities. PHP runs about 70 percent of the world's websites.

Earlier this month, authorities worldwide urged website administrators to carry out emergency updates after a nonprofit programming foundation flagged critical security flaws that could allow hackers to breach systems. The vulnerabilities, nicknamed PHP2Shell, were discovered by independent cybersecurity experts using AI, and government and corporate websites briefly went offline to patch them.

The vulnerabilities had been embedded in PHP's code for more than a decade. They had gone unnoticed because it would have been too complicated for humans to exploit them without the use of advanced AI.

Cybersecurity experts and those maintaining important software say PHP2Shell could be the first in a deluge of security flaws exposed by emerging AI. They say much of the world's most critical digital infrastructure is maintained by volunteers, who often lack the resources and time to respond to newly discovered threats.

Peter Slattery, a research scientist at MIT's FutureTech who studies how cybersecurity experts are dealing with the new technology and tracks real-world incidents involving AI, said many in the AI safety community had said this is one of the first areas where the harmful impact of AI would be seen.

PHP got its start in 1995, when Danish-Canadian programmer Rasmus Lerdorf sought to track how many people visited his online resume. Others around the world later improved the software. Websites like Facebook and Wikipedia were built using PHP. In 2021, the nonprofit PHP Foundation was launched to coordinate development, operating on a meagre budget.

Most of the digital infrastructure consumers use is powered by open source software — the Mozilla Firefox browser, languages like Perl, Python and JavaScript, and the Apache HTTP Server maintained by the Apache Software Foundation. Amanda Brock, CEO of the nonprofit OpenUK, said: ‘The world today, including proprietary software vendors, relies on open source software for its digital infrastructure.’

The world's largest corporations, like Meta, Google, OpenAI and Anthropic, depend on that volunteer-built infrastructure. Now those companies' own AI tools are uncovering security flaws at a pace that needs far more resources for groups like the PHP Foundation to keep up. Brock said it is simply not possible with the resources in place to fix all of the known vulnerabilities, and smaller foundations do not have hundreds of millions in funding.

Developers of other software are also discovering far more flaws because AI is being used to probe defences. Google said it uncovered more than 1,000 security bugs in the last update for its Chrome browser, more than in the last two dozen updates combined. Mozilla, behind the Firefox browser, found more than 400 vulnerabilities in April, a significant jump from the previous record of 76 just one month earlier.

Jarek Potiuk, part of the volunteer security team at the Apache Software Foundation, said: ‘We have maybe 10 times more issues than usual because we are using AI to find them.’ He said there is an industry-wide movement to conduct scans using AI models, but the scans cost money to pay for AI tokens and humans must afterwards pore over them to weed out false positives.

Earlier this year, Anthropic launched Project Glasswing, offering $100m in credits to support its advanced Claude Mythos AI model to search for security vulnerabilities in the world's critical software. In one month, more than 23,000 vulnerabilities were found across more than 1,000 open source projects. The Apache Foundation has also used the Alpha-Omega project, backed by Anthropic, Amazon, Google, Microsoft and OpenAI, which spends about $7m a year and scans the 290 software packages the foundation maintains.

Potiuk said fixing a major flaw often comes down to a handful of volunteers and that the corporate world could do more, suggesting major players like Google or Microsoft could pay staff to dedicate some work hours to maintaining open-source projects they use instead of buying out something like PHP. The 2021 Log4Shell vulnerability, which allowed hackers to remotely run code on millions of devices through a library maintained by the Apache Foundation, underscored that role — and that bug was discovered without AI.

Slattery said the database of incidents he and his colleagues maintain shows an increasing number of vulnerabilities being detected, and it is a matter of time before some are exploited in the real world. ‘We are starting to see both a lot more vulnerabilities detected and addressed in time, but also attacks on a wide range of systems,’ he said.