22-Year-Old Internet Security Flaw Becomes AI-Fueled Crisis in Just Two Days

A critical vulnerability in PHP, the programming language powering 70% of global websites, has been known for 22 years. Security researcher Stefan Esser first warned of this flaw in July 2004, highlighting its potential to allow attackers to access passwords, steal databases, or even seize control of entire websites. Despite Esser's warning, the issue was largely ignored for decades. In 2020, a related problem was identified, leading to a partial fix from PHP overseers. A similar vulnerability resurfaced in 2024 but remained unaddressed.

The reason for this prolonged inaction was the immense difficulty for humans to exploit the vulnerability, requiring tedious and time-consuming coding. This made it impractical for malicious actors. However, Artificial Intelligence has drastically changed this landscape, with OpenAI's AI discovering how to exploit the flaw in just two days. OpenAI announced the exploit's public revelation on Wednesday, coinciding with a security update to address the problem.

This AI-assisted discovery has deeply concerned cybersecurity experts, as future vulnerabilities could be weaponized by malicious actors with AI's speed and efficiency. The internet's infrastructure, often described as being held together by