The PHP Meltdown Indicates How AI Makes Bugs More Exploitable
Compiled by KHAO Editorial — aggregated from 1 source. See llms.txt for citation guidance.
◌ Single Source
Welcome to Kernel Panic, a weekly newsletter by Lily Hay Newman and Matt Burgess from inside the new world of privacy and digital security.
Key facts
- Welcome to Kernel Panic, a weekly newsletter by Lily Hay Newman and Matt Burgess from inside the new world of privacy and digital security
- Some of the underlying issues were identified in 2024 but were deemed too complex to exploit at the time
- Microsoft’s security updates included a record 1,453 security vulnerabilities this month alone
- Meanwhile, Bank of America recently hired 1,000 consultants to fix flaws discovered by Anthropic’s Mythos
Summary
As security teams and web admins scrambled this week to patch newly public PHP bugs, criminal hackers quickly attempted to exploit the flaws in the wild. So far, the nightmare scenario of mass victim takeovers and breaches hasn’t come to pass. So are they all about to be walloped by a wave of critical vulnerabilities that have been kicking around for decades? Researchers at security company Calif were the first to identify the PHP2Shell vulnerabilities and create exploits in early August—partially using frontier AI tools as part of OpenAI’s Patch the Planet program, but also using expert human knowledge of PHP, its dynamics, and its weaknesses.