[Reading Science] AI Uncovers a Critical Internet Vulnerability... Worldwide on Alert

Two PHP Vulnerabilities Hidden for Over a Decade Discovered... Server Takeover Possible
AI Lowers the Barrier to Attacks... Cybersecurity Systems Shaken

The internet we use every day has hidden weaknesses that no one has properly examined for decades. Countless developers review code and security experts search for vulnerabilities, but it is difficult to find every flaw in complex, interconnected programs. Moreover, even when a flaw was discovered, it was sometimes considered low-risk if it seemed difficult to exploit in a real attack. Artificial intelligence (AI) is upending this long-held belief.

Two critical security vulnerabilities have been discovered in PHP, a programming language widely used on websites around the world. The discovery has sent shock waves because AI helped researchers analyze flaws that had existed for more than a decade and turn them into attacks capable of taking over real web servers. Experts warn that the incident could be a turning point in how cyberattacks are carried out and defended against in the AI era, going beyond a simple software security incident.

A fatal vulnerability in PHP, a web programming language, was exposed through security research using artificial intelligence (AI), raising alarm over internet security worldwide. The image, generated by AI, depicts PHP's memory safety flaws and the security threats they pose to websites.

According to announcements on Oct. 23 by cybersecurity firm Wiz and the PHP development team, the vulnerabilities are known as "PHP2Shell." Their Common Vulnerabilities and Exposures (CVE) identifiers are CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities received a score of 9.2 under the Common Vulnerability Scoring System (CVSS), placing them in the highest risk category: "Critical."

PHP is a core programming language that works behind the scenes on the internet. When users log in to a website or order something from an online store, web servers use it to process information and communicate with databases. It is also the foundation for widely used website-building tools such as WordPress, Drupal, and Joomla.

Wiz estimated that about 70% of websites worldwide use PHP. However, this does not mean that 70% of all websites are exposed to hacking. The actual risk depends on the PHP version, server configuration, and whether security patches have been applied.

A Small Memory Error Can Lead to Server Takeover... AI Breaks Through Technical Barriers

The vulnerability stems from the way computers manage memory. As a program performs tasks, it stores the data it needs in memory and releases that space once the tasks are complete. Problems can arise when memory runs low or a critical error occurs in the program.

When a request being processed exceeds the configured memory limit, PHP stops execution and cleans up the resources it was using. Researchers found that, during this process, some data may not be fully initialized, or the program may refer again to memory that has already been freed.

One example is a memory safety flaw known as "Use After Free." This occurs when a program reads or writes to memory that it should no longer use. If an attacker exploits this behavior, they may be able to read passwords or authentication information used in other requests, or alter the program's execution flow.

While common website hacks target flaws in individual programs, such as login functions or bulletin boards, this vulnerability targets the PHP execution engine itself, which operates beneath them. This means a website can be attacked if its execution environment is vulnerable, even if there is nothing particularly wrong with the website's application code.

Wiz researchers successfully executed arbitrary commands on servers without logging in, in test environments running WordPress, Drupal, and Joomla. They also confirmed the possibility of accessing sensitive information remaining in server memory, including passwords, authentication tokens, and application programming interface (API) keys.

Security researchers demonstrate how a vulnerability in PHP can be exploited to remotely execute commands on a web server. They confirmed that server commands could be run without logging in on WordPress, Drupal, and Joomla sites. Photo by the PHP2Shell research team.

Lee Gihyeok, a professor at Chung-Ang University's Graduate School of Security, explained, "This vulnerability is a memory safety flaw that occurs when the PHP engine handles critical errors, such as running out of memory. Because it is a problem with the execution environment itself, rather than with individual applications, it is comparable to Heartbleed and Log4Shell."

Why, then, has a flaw that existed for so long only now emerged as a serious threat?

The existence of a vulnerability and the ability to exploit it in a real attack are two different things. To take over a server using a memory error, attackers must link multiple flaws and precisely understand the sequence in which a program stores and frees data. The attack method also needs to be modified when the PHP version or server configuration changes.

In the past, this kind of work required extensive analysis and repeated experiments by highly skilled security experts. This time, however, AI was used to analyze code, verify whether it could be exploited, identify the reasons for failed attempts, and modify the attack method.

Wiz researchers said they used Google's DeepMind Gemini and models from OpenAI's GPT family, among others. They said AI significantly reduced the time needed to adapt and test the attack method for different server environments.

Kim Gyeonggon, a professor in the cybersecurity program at Ravensbourne University London in the United Kingdom, said, "The discovery of this PHP vulnerability marks the beginning of the changes AI will bring to cybersecurity. What matters is that AI has made it possible to discover complex vulnerabilities much faster and verify whether they can be exploited in real attacks, tasks that once required skilled security experts to spend a long time analyzing them."

However, it would be inaccurate to say that AI found all the vulnerabilities on its own, without human involvement.

Rebecca Johnson, an expert in AI evaluation and governance at the University of Sydney in Australia, said, "AI did not discover the PHP flaws by itself. Security researchers knew where to look and used AI based on decades of accumulated research." She emphasized, "This discovery demonstrates AI's capabilities, but how reliably these systems work and how much guidance they need from human experts must be evaluated separately."

The Time Gap Between Attack and Defense Is Closing... A New Test for Internet Security

The biggest problem raised by this incident is the speed of cyberattacks. Traditionally, when security researchers discovered a vulnerability, they would first notify the software developer, who would then create and release a fix. This process was based on the assumption that even after a vulnerability became known, attackers would need considerable time to develop a way to exploit it in a real attack.

AI is narrowing this time gap. If security experts can use AI to quickly analyze complex flaws, attackers can use the same technology as well. Vulnerabilities that were previously considered relatively low-risk because they were difficult to exploit could increasingly become real threats.

Shannan Cooney, a senior lecturer in the Faculty of Engineering and Information Technology at the University of Melbourne in Australia, said, "In the past, even if the existence of a vulnerability was disclosed in advance, attackers needed time to identify the specific flaw. As AI changes this situation, we need to reconsider whether existing vulnerability disclosure procedures are still appropriate."

AI Discovers PHP Security Vulnerability. AI-Generated Image

Some predict that a so-called "AI vs. AI" cybersecurity contest could take hold, with AI accelerating both vulnerability detection and the development of attack methods. Defenders will need to use AI to find and fix software flaws first, while attackers can use the same technology to identify systems that have not yet been patched.

A bigger problem is that the internet runs on the combination of countless software components. A single website may use PHP, along with various other programs, external libraries, databases, and server management tools. If even one of these has an unpatched vulnerability, the entire system could be at risk.

Rahat Masood, a senior lecturer in cybersecurity at the University of New South Wales in Australia, said, "Even if an organization has completed security patching on its own website, attackers can exploit vulnerabilities that remain in external software or related components. Organizations need to know the security status of all the software they use, as well as that of their external suppliers."

Responses are already underway. On Oct. 21, the PHP development team released PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, which fix the vulnerabilities, and urged users to update immediately. The Korea Internet & Security Agency (KISA) also issued a security notice that day, urging users to update affected versions.

The problem is older systems. Official security support has ended for PHP 8.1 and earlier versions, making it difficult to apply the latest security patches in some cases. Some operating system vendors provide separate fixes, but systems without such fixes need to be migrated to a supported version.

Systems managed by external contractors for development and maintenance are also subject to review, including websites for public institutions, local governments, and schools in South Korea. If the PHP versions used by older websites are not properly tracked, it may be difficult to respond immediately even after a security patch is released.

Professor Lee emphasized, "I am particularly concerned that many outsourced websites whose maintenance contracts have ended, as well as local government and school websites in South Korea, are left running outdated PHP versions that are no longer supported. The patch response cycle needs to be shortened to a matter of days."

This does not mean that every website using PHP has suffered an actual hacking incident. Some attack attempts have been observed, but the overall scale of the breaches has not been confirmed. Institutions that temporarily suspended their websites may have done so as a precaution to apply security patches, not because they had been hacked.

The incident brings to mind the "Heartbleed" vulnerability discovered in 2014 in OpenSSL, a foundation of encrypted internet communications, and the "Log4Shell" vulnerability discovered in 2021 in a Java-based logging tool. Both incidents showed that a small flaw in widely used software can affect internet services around the world.

PHP2Shell raises a new question: If AI can turn even vulnerabilities once considered difficult to exploit into real attack methods, how quickly can existing security systems respond?

Johnson said, "The real danger is that the gap is widening between how quickly vulnerabilities can be made exploitable and how quickly organizations can protect themselves. AI can help find flaws and develop fixes, but no one is protected until the patches are actually applied."

Professor Kim said, "Going forward, competitiveness in cybersecurity will depend less on AI technology itself and more on how strategically it can be used and controlled."

This content was produced with the assistance of AI translation services.