AI-discovered PHP flaws prompt software patching
Companies and government agencies moved to patch two critical vulnerabilities in PHP after they were discovered using a powerful OpenAI model, AFP reported. Cyber Threat Alliance president Michael Daniel said AI-assisted discovery could produce many more findings, while exploitation timelines have shortened from months to hours or days. [11]
Why it matters
Organizations face two simultaneous tasks: deploying genuine fixes quickly and filtering out reports that are incorrect or concern software that is not exposed to the internet. Daniel said smaller organizations should prepare to accept vendor updates as quickly as they can. [11]
Key insights
- Daniel described the PHP findings as genuine vulnerabilities while cautioning that many other AI-generated findings are noise. [11]
- He put the historical exploitation rate at five or six percent and said there was no indication that proportion was rising. [11]
- His distinction is speed rather than necessarily a higher exploitation rate: proof-of-concept and exploit-kit timelines that once took months can now be measured in hours or days. [11]