Cybersecurity leaders warn of 'vulnerability tsunami' after AI finds critical PHP flaws

Some experts estimated that 70% of all sites on the internet were at risk of hacking, according to the report. The discovery pushed the security community into a public warning about how quickly AI can find fundamental weaknesses in global internet infrastructure and how quickly malicious actors may try to exploit them.

Sam Altman said on Thursday evening: 'I no longer think we're going to be able to patch all bugs.' He joined other technology executives in warning that AI will be used both to identify and exploit security vulnerabilities at an unprecedented scale and pace.

Jason Clinton, Anthropic's deputy chief information security officer, said the next few months would bring a 'vulnerability tsunami'. 'There won't be enough time to patch critical infrastructure,' Clinton said in a post on X on Thursday evening. Marc Benioff, the Salesforce CEO, agreed and called it a 'code red'.

Matthew Prince, the Cloudflare CEO, said AI was uniquely able to find and identify security flaws in a way and at a pace that would feel catastrophic because the security community would not be able to move quickly enough to address them. 'It's going to feel like the sky is falling. It's going to feel like there's nothing we can do,' he wrote in a post on X. He added that the next two years would be 'incredibly, incredibly, incredibly fraught with new tools that have infinite patience to go look for vulnerabilities across the Internet'.

Attempts to exploit the PHP vulnerability have already begun, according to the report. After the vulnerabilities were announced, government and private websites across the US and UK temporarily took down their sites to patch the bugs. The US National Security Agency issued an alert recommending that any site running on PHP implement the patches immediately. The agency said malicious cyber actors may seek to further exploit the bugs to access servers without authorization. 'Such an access vector could help attackers steal sensitive data, disrupt services or move deeper into a network,' the warning read.

Prince said Cloudflare had seen evidence of thousands of people trying to exploit the PHP flaws in the 10 hours before the announcement. 'That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now,' he wrote.

Researchers at the AI security platform Wiz said in a blogpost that this was 'among the most severe vulnerabilities discovered in PHP, and arguably in software history'. They said the underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve.