AI found a longstanding PHP vulnerability; patch released early — TIME

Researchers at Wiz used an AI agent to discover a vulnerability in PHP, the programming language on which WordPress, Drupal and, according to the source, up to 70% of the web depend. The vulnerability had gone unnoticed for more than a decade. TIME reports.

In early August, Wiz researcher Sagi Tzadik tasked an AI agent with checking whether a previously found WordPress weakness could be used against Drupal. Eight hours later, the agent reported that the attempt had failed, but it had also discovered a problem in PHP during the check. Tzadik initially assumed that the model had made a mistake, but the vulnerability was confirmed.

Parallel research and an urgent update

Separately, researchers at Calif, who worked with OpenAI, also used AI to find a related vulnerability. After Wiz and Calif submitted reports to PHP developers, specialists from both companies joined forces to find the common source of the problems and prepare a fix.

About 15 people took part in the work and communicated almost daily for several weeks. Wiz Chief Technology Officer and co-founder Tomer Schwartz said that the cooperation between competing companies took place without contracts and was based on trust.

More current news is available on the UA.News Telegram channel Telegram.

Leak of details triggered a wave of exploitation attempts

Information about the vulnerabilities began spreading online two days before the planned release of the update. As a result, PHP maintainers moved the patch release one day earlier. Calif later mistakenly published a video demonstrating how its exploit worked, and the number of repeated exploitation attempts rose sharply.

Cloudflare recorded thousands of such attempts even before the public announcement, tens of thousands within 45 minutes afterward, hundreds of thousands within two hours, and later their number reached millions. Even after the patch was released, some websites, including pages of government institutions and parts of Wikipedia, temporarily stopped operating as a precaution while security teams installed the update.

According to Tzadik, AI agents make it possible to test many hypotheses in parallel, reducing months of traditional research to days or hours. At the same time, after discovering the problem, Wiz specialists spent several more days understanding its mechanism and reproducing it.