Amazon warns that a new PHP vulnerability discovered by AI is being exploited at scale
Amazon said that two PHP security vulnerabilities discovered by researchers using OpenAI and Google AI models had already been attempted to be exploited by hackers four days before public disclosure, and are now being widely exploited. The NSA and the UK NCSC warned organizations using PHP to update their systems immediately, or otherwise take them offline temporarily; the PHP maintainers have released a fix update, and Wiz estimates that PHP underpins about 70% of websites worldwide. OpenAI said this is a case of frontier AI models discovering vulnerabilities before attackers, but the same capability could also help attackers develop exploit programs.
Why read this
SelectedAI score 87
AI models discovered a PHP vulnerability before attackers, but it was already exploited four days before disclosure, presenting a reality in which both attack and defense are accelerating simultaneously.
Topics
Body · AI translation
The world's largest cloud computing provider said on Wednesday that it had found that hackers attempted to exploit the vulnerabilities as early as four days before they were publicly disclosed.
Amazon added that these vulnerabilities "are currently being widely exploited in real-world network environments."
Earlier that day, the US National Security Agency (NSA) and UK authorities warned that these vulnerabilities put websites around the world at extremely high risk of hacker attacks. Reports said that some European governments had temporarily taken some websites offline while patching the two security flaws.
The vulnerabilities went undetected for more than a decade until researchers identified them with the help of AI models from OpenAI and Google. The breadth of their potential impact highlights AI's ability to disrupt the cybersecurity landscape.
Earlier this year, Anthropic and OpenAI successively launched new models with powerful cybersecurity capabilities, prompting warnings from politicians and financial regulators and leading the US government to temporarily restrict the release of these models.
On Wednesday, the NSA warned all organizations using the programming language known as PHP to update their systems immediately or take the relevant systems offline.
The developers responsible for maintaining PHP released a software update earlier that day to fix the vulnerabilities.
The NSA said: "These vulnerabilities often allow attackers to gain direct access to a server's file system or database. If updates cannot be completed immediately, organizations are advised to temporarily take systems offline until the vulnerabilities are fully patched."
Researchers at Calif and Wiz, two US cybersecurity firms, discovered the vulnerabilities. Wiz, owned by Google parent Alphabet, estimates that the vulnerable PHP programming language underpins about 70% of websites worldwide.
OpenAI said on Wednesday: "Given the severity of these vulnerabilities and the widespread use of PHP, we believe this is one of the most significant cybersecurity issues in recent years. To our knowledge, frontier AI models discovered these vulnerabilities before attackers did."
OpenAI added: "This highlights AI's ability to discover security flaws that could affect the entire internet, but the same capability could also help attackers rapidly develop attack tools and exploits."
OpenAI worked with PHP, Calif and Wiz to jointly verify the vulnerabilities and develop corresponding patches.
The White House said federal agencies are assessing the potential impact of these vulnerabilities on government systems and critical infrastructure.
PHP is widely used on the internet mainly because WordPress, the world's most widely used website-building platform, is primarily written in PHP and relies on the language to run.
The UK National Cyber Security Centre (NCSC) said these vulnerabilities could allow hackers to take control of website servers without passwords or other login credentials.
The agency said: "The UK National Cyber Security Centre is urging UK organizations to take action immediately."