In July 2004, security researcher Stefan Esser sent a warning.
A critical flaw in PHP, the programming language that powers 70% of the world’s websites, could allow an attacker to do some seriously nefarious stuff: read passwords, steal databases or even take over entire websites.
But Esser’s warning went mostly ignored for decades. In 2020, another researcher discovered a related problem, and the PHP overseers issued a partial fix. A similar PHP vulnerability was uncovered in 2024 – but was left unfixed.
Why was one of the most severe threats to the foundation of the internet left unresolved for 22 years?
Because it would have taken mind-numbing work for a human to figure out how to take advantage of it: tedious, time-consuming, monotonous coding. That rendered the PHP vulnerability impractical to exploit.
AI just figured out how to do it in two days.
On Wednesday, OpenAI’s public revelation of the exploit was announced in conjunction with a security update to fix the problem.
Phew, you might think. The good guys got to it first. But the AI-assisted discovery deeply concerned cybersecurity researchers, because the next one might come from someone who wants to weaponize it.
> Why was one of the most severe threats to the foundation of the internet left unresolved for 22 years?
> Because it would have taken mind-numbing work for a human to figure out how to take advantage of it: tedious, time-consuming, monotonous coding. That rendered the PHP vulnerability impractical to exploit.
This excuse sounds bogus to me. They had known use-after-free bugs in their software, but didn't fix them because probably no one could exploit them from outside. Bad practices.
What if we trained AI to be conscientious, honest, and compassionate?
This story to me sounds like someone repeatedly punching themselves in the face and then complaining that their nose is broken. Tech researchers did this to themselves.
Us the public have next to no say what idiots in charge will train their AI to do, is basically the issue.
There needs to be a lot more international cooperation and government limitations rather than just techbros running blindly in every direction then crying when stuff blows up in their face
Are you talking about the AIs used by the people who collaborated with the PHP Foundation to identify and fix the vulnerability, or the AIs without safety limits that are used by hackers to mass-exploit production systems? They're generally not made by the same people.
And "we" includes hackers, nation-state actors, Chinese companies, users of open-source models ? They're all going to agree to use AI only for nice things ?
[OP] cnn | a day ago
Analysis:
In July 2004, security researcher Stefan Esser sent a warning.
A critical flaw in PHP, the programming language that powers 70% of the world’s websites, could allow an attacker to do some seriously nefarious stuff: read passwords, steal databases or even take over entire websites.
But Esser’s warning went mostly ignored for decades. In 2020, another researcher discovered a related problem, and the PHP overseers issued a partial fix. A similar PHP vulnerability was uncovered in 2024 – but was left unfixed.
Why was one of the most severe threats to the foundation of the internet left unresolved for 22 years?
Because it would have taken mind-numbing work for a human to figure out how to take advantage of it: tedious, time-consuming, monotonous coding. That rendered the PHP vulnerability impractical to exploit.
AI just figured out how to do it in two days.
On Wednesday, OpenAI’s public revelation of the exploit was announced in conjunction with a security update to fix the problem.
Phew, you might think. The good guys got to it first. But the AI-assisted discovery deeply concerned cybersecurity researchers, because the next one might come from someone who wants to weaponize it.
And AI doesn’t care who’s pulling the trigger.
robertDouglass | 23 hours ago
no, humans not following rules made it a crisis in 2 days
billdietrich1 | 16 hours ago
> Why was one of the most severe threats to the foundation of the internet left unresolved for 22 years?
> Because it would have taken mind-numbing work for a human to figure out how to take advantage of it: tedious, time-consuming, monotonous coding. That rendered the PHP vulnerability impractical to exploit.
This excuse sounds bogus to me. They had known use-after-free bugs in their software, but didn't fix them because probably no one could exploit them from outside. Bad practices.
nickshambo | 15 hours ago
ai written cnn add
redrightreturning | 18 hours ago
What if we didn’t train AI to hack shit?
What if we trained AI to be conscientious, honest, and compassionate?
This story to me sounds like someone repeatedly punching themselves in the face and then complaining that their nose is broken. Tech researchers did this to themselves.
AwTomorrow | 18 hours ago
Us the public have next to no say what idiots in charge will train their AI to do, is basically the issue.
There needs to be a lot more international cooperation and government limitations rather than just techbros running blindly in every direction then crying when stuff blows up in their face
redrightreturning | 17 hours ago
10000% agree.
I also wish media would be more vocally critical. So many institutions with power to affect change are complicit in this.
neuronexmachina | 16 hours ago
Are you talking about the AIs used by the people who collaborated with the PHP Foundation to identify and fix the vulnerability, or the AIs without safety limits that are used by hackers to mass-exploit production systems? They're generally not made by the same people.
billdietrich1 | 16 hours ago
> What if we didn’t train AI to hack shit?
And "we" includes hackers, nation-state actors, Chinese companies, users of open-source models ? They're all going to agree to use AI only for nice things ?