One of the unsung backbones of the modern internet is under threat.
Driving the news: Developers of PHP — a programming language that powers as much as 70% of the internet — warned of two vulnerabilities that hackers could use to take control of systems (in mere seconds in some cases), and urged users to apply newly released security patches. Many websites, including government of Canada sites, went offline as a precaution.
Researchers initially discovered the vulnerability in August and have been working on patches since then. They were supposed to be released today, but researchers were forced to release it a day early after news of the vulnerability leaked on Hacker News.
Why it matters: This bug had been hiding in PHP for years, and it likely would have stayed hidden were it not for the advent of new AI cybersecurity models (the researcher who first uncovered it was using OpenAI’s ultrapowerful GPT-5.6 Sol model). The situation speaks to the growing fear of Bugmageddon, where AI unleashes a flood of unpatched vulnerabilities.
On top of this, these same AI tools allow black-hat hackers to exploit bugs faster than ever and analyze patches to find workarounds.
What’s next: One security consultant told Wired that the “worst case is wormable malware affecting big chunks of the internet.” As of writing, there is no major confirmed breach, but since the use of PHP is so pervasive, fears remain that something will happen.—QH
