Daily AI Briefing

AI-assisted research uncovers critical PHP flaws as attacks emerge

Researchers using AI models uncovered two critical flaws in PHP, software estimated to power about 70% of websites, that could let unauthenticated attackers run code on servers. PHP released fixes across supported 8.x versions, and security agencies urged organizations to update immediately or take vulnerable systems offline, according to Ars Technica’s report.

The response was complicated by leaked disclosure details and circulating proof-of-concept exploits; the PHP Foundation says these prompted it to release the fixes a day early. The New York Times reported that some government sites temporarily went offline. The incident highlights AI’s dual use: it helped defenders find the flaws but could also help attackers develop exploits faster, the paper reported.

• WSJ: What to Know About the AI-Triggered PHP Crisis Taking Websites Offline
• WSJ: AI Just Found a Bug That Puts Up to 70% of the World’s Websites at Risk
• Don’t Worry About the Vase: The Hackening
• Simon Willison: Today’s PHP Security Release, and How We’re Strengthening PHP Security
• Transformer: PHP code flaw begins the cyberpocalypse — sort of

AI-driven cyberattacks strain defenses as software flaws multiply

AI tools are helping criminals and state-linked hackers find vulnerabilities, break into systems and steal data faster, while cybersecurity teams race to patch flaws. The Wall Street Journal reports that a newly disclosed vulnerability could put up to 70% of websites at risk, prompting urgent patches and temporary shutdowns of some government sites. The Journal also describes attacks using the Chinese tool Artex, as well as credentials stolen from an AI coding platform.

Other accounts highlight the breadth of the risks: Microsoft said a Chinese group used AI agents to gain cloud-account access in under three hours, while attackers made thousands of login attempts per minute, according to Exponential View. The reports underscore how AI is raising the speed and scale of cyber threats across online services and organizations, as Noah Smith notes. (Ryan Orhan, John Gedmark)