▲ Hacking Alert
Companies and organizations around the world are on high alert following the discovery of critical security vulnerabilities in a programming language widely used across global websites.
In particular, artificial intelligence is known to have played a decisive role in uncovering these security flaws, raising growing concerns that hackers could also leverage AI to launch large-scale attacks.
According to outlets such as The Wall Street Journal and Reuters on the 21st (local time), the development team behind PHP, a programming language extensively used for website development, urgently released a new version patching two critical security vulnerabilities on the same day.
These vulnerabilities are known to allow hackers to execute arbitrary code remotely or take control of systems without requiring any login or authentication procedures.
The widespread impact of this situation stems from the fact that PHP is a core technology heavily utilized across the internet.
According to web technology analysis firm W3Techs, approximately 75% of websites with identifiable programming languages use PHP.
WordPress, a website creation and management system used by about 43% of all websites, also operates on a PHP-based infrastructure.
Notably, these vulnerabilities were discovered using AI, and they are regarded as severe security flaws that went unnoticed for over a decade.
Cybersecurity firm Calif used OpenAI’s model “GPT-5.6 Sol” to find the vulnerabilities, while Wiz, a Google-affiliated cybersecurity company, independently discovered and reported two vulnerabilities.
These flaws had existed in the PHP code for years and were pointed out as potential issues in the past, but they had been considered too difficult to exploit in actual attacks.
Ami Luttwak, co-founder of Wiz, described the flaws, stating, “This is the most severe security vulnerability ever discovered by AI,” adding, “Without AI, it would have been too complex to find.”
OpenAI also stated in a release, “Considering the severity of this flaw and the widespread use of PHP, we evaluate this as one of the most impactful security vulnerabilities in recent times.”
The PHP development team originally planned to release the security patch on the 22nd, but moved the distribution schedule up by a day after related information was leaked on an online message board on the 20th.
However, concerns are spreading as it has been reported that some hackers attempted attacks exploiting the vulnerabilities even before the security patches were distributed.
Dane Knecht, Chief Technology Officer at web and cloud security firm Cloudflare, stated, “Initial attack attempts are appearing, and we are updating response measures whenever new attack paths are discovered.”
In fact, government agencies in some European countries, including the Netherlands and Finland, suspended website operations as a preventive measure, and cybersecurity authorities in Europe, Japan, and Australia have also recommended emergency updates.
※ Please note: This article was translated by AI and may contain errors.
Click Here For The Original Source.
——————————————————–
