Cyber Awareness

AI‑Driven Discoveries Expose PHP Vulnerabilities, Raising Concerns for Volunteer‑Run Open‑Source Infrastructure

By Umar Farooq

Earlier this month, authorities worldwide urged website administrators to apply emergency updates after a nonprofit programming foundation flagged critical security flaws that could allow hackers to breach systems. The vulnerabilities, dubbed PHP2Shell, were discovered by independent cybersecurity experts using artificial intelligence (AI) and were embedded in the code of PHP, a widely used open‑source web programming language that powers about 70 percent of the world’s websites. The flaws had gone unnoticed for more than a decade because exploiting them would have been too complex for humans without advanced AI.

PHP2Shell was found through several advanced AI models that can attempt more complicated hacks than humans could. The discovery has prompted concerns that PHP2Shell could be the first of many security flaws exposed by emerging AI. Cybersecurity experts and maintainers of critical software say that much of the world’s most essential digital infrastructure is maintained by volunteers who often lack the resources and time to respond to newly discovered threats.

Peter Slattery, a research scientist at MIT’s FutureTech, said the AI safety community has identified this as one of the first areas where AI’s harmful impact is becoming evident. Amanda Brock, CEO of OpenUK, noted that the world’s largest corporations—Meta, Google, OpenAI and Anthropic—depend on volunteer‑built, open‑source infrastructure. She added that foundations like the PHP Foundation operate on a meagre budget and cannot keep pace with the rate at which AI is uncovering vulnerabilities.

The PHP2Shell vulnerabilities were discovered by AI models that can employ far more complicated attempts to bypass security barriers than humans could. Developers of other software are also finding far more security flaws than in the past because AI is being used to probe defenses. Google reported more than 1,000 security bugs in its last Chrome update, more than in the previous 24 updates combined. Mozilla found more than 400 security vulnerabilities in April, a significant jump from the previous record of 76 bugs discovered just one month earlier.

Jarek Potiuk, part of the volunteer security team at the Apache Software Foundation, said the industry is moving toward AI‑based scans to identify security vulnerabilities. However, the scans themselves cost money—used to pay for the tokens for AI models—and afterwards, humans must review them to weed out false positives.

Earlier this year, Anthropic launched Project Glasswing, offering $100 million in credits to support its advanced Claude Mythos AI model to search for security vulnerabilities in critical software. In one month, more than 23,000 vulnerabilities were found across more than 1,000 open‑source projects. The Apache Software Foundation has also used the Alpha‑Omega project, backed by companies such as Anthropic, Amazon, Google, Microsoft and OpenAI, to scan for security bugs across the 290 software packages it maintains. The project spends about $7 million a year helping open‑source developers find critical security bugs.

When a major security flaw like PHP2Shell is uncovered, it often comes down to a handful of volunteers to fix it. Potiuk said keeping the internet’s infrastructure as decentralized and open‑source as possible is crucial. He suggested that major players such as Google or Microsoft could pay staff to dedicate some of their work hours to maintaining open‑source projects they use.

The 2021 Log4Shell vulnerability, which allowed hackers to remotely run code on millions of devices through a widely used library maintained by the Apache Software Foundation, underscored the critical role open‑source software plays in system security. That bug was discovered without the use of AI and exposed cars, microwaves and a host of internet‑connected devices to vulnerability.

Slattery said the database of incidents he and his colleagues maintain shows that an increasing number of vulnerabilities are being detected, and it is a matter of time before some are exploited in the real world. He noted that while more vulnerabilities are being detected and addressed in time, there are also more attacks on a wide range of systems, indicating a growing threat landscape.