COMMENTARY: Two critical vulnerabilities in PHP last week sent a good chunk of the internet scrambling to patch. Government agencies took services offline, businesses proactively shut down websites, and security professionals worked around the clock to patch their systems.
At our group, we saw the disruption firsthand – 25% of our customers' domains were temporarily taken offline.
[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]
The vulnerabilities, dubbed PHP2Shell, impacted roughly 70% of websites on the internet and could let unauthenticated attackers execute code on vulnerable servers. The flaws had existed in PHP’s codebase for more than two decades before AI-assisted security research helped to uncover them.
PHP2Shell represents a high-profile example of what AI has made possible in cybersecurity. Researchers are now finding vulnerabilities that have gone undetected for years, or, as was the case with PHP2Shell and the 27-year-old vulnerability Anthropic found in OpenBSD, decades. And it’s only a matter of time before AI lights up decades’ worth of undiscovered vulnerabilities.
Researchers can now use advanced models to analyze large codebases and investigate attack paths that might otherwise take months to discover. We’ve already seen examples in the Linux kernel, which security researchers have studied for decades. As these capabilities improve, we’ll likely see a substantial increase in discovered vulnerabilities across open-source and proprietary software. Security teams already struggle to keep up with disclosures. Just imagine what happens when discovery gets several times faster.
Finding a vulnerability doesn’t mean attackers can exploit it
One point getting lost in the discussion is the difference between finding a vulnerability and successfully exploiting it.
Take PHP2Shell as an example. Amazon Threat Intelligence observed exploitation attempts beginning October 17, several days before patches became available. But early attempts were frequently unsuccessful. Our offensive security researchers had difficulty developing a proof of concept that could reliably exploit the vulnerability.
Successful exploitation has since been reported, so there’s a real danger. PHP2Shell is serious -- an unauthenticated attacker potentially gaining complete access to a server is about as bad as it gets. But that doesn’t mean attackers can exploit it easily or at scale.
Nor does it mean organizations were wrong to take services offline. Depending on the consequences of a compromise, that may have been the most sensible decision. Now, we have to figure out what’s exploitable and how much risk we’re willing to accept, especially when there’s enormous pressure to act.
Can defenders get ahead?
With the availability of AI, defenders can now use the same models to find vulnerabilities before attackers do. OpenAI and Anthropic are giving vetted security organizations early access to models with advanced cybersecurity capabilities, allowing them to find and fix vulnerabilities before attackers can exploit them.
That should give defenders an advantage: we’re able to work with models that aren’t generally accessible to attackers, at least not yet. But there’s still the question of scale.
Attackers can continuously scan large numbers of systems. Defenders have sprawling infrastructure, legacy applications and limited resources. Better tools will help, but not every organization will find and fix every vulnerability before someone tries to exploit it. Knowing what’s exposed, what’s exploitable, and what needs fixing first will become even more important.
There’s also an opportunity to change how we develop software. If AI can find vulnerabilities in code written 20 years ago, it can find them in code being written today. We may finally have the tools to make Secure-by-Design development more practical.
The storm before the calm?
Every vulnerability discovered and patched represents one less flaw sitting unnoticed in software. Sophisticated threat actors may already know some of them. So, finding and fixing them makes software safer for everyone.
I also think there’s a good chance that AI-assisted security testing will dramatically improve software quality. If AI can make more secure approaches to software development widely accessible, then software built in the coming years could wind up being considerably more secure than what we’re using today.
But I wouldn’t count on that happening anytime soon. In the meantime, we should expect more vulnerability disclosures, emergency patches, and some difficult decisions for security teams.
While it’s an encouraging long-term outlook, getting there could be painful.
For now, I’d prepare for the storm.
Klaas Meinke, Head of AI, Hadrian
SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
