Far down the quiet pipes that carry the world's websites, a language begun in 1995 to count visitors to one programmer's résumé has been found to hide flaws that lay unseen for more than a decade. It took artificial intelligence, able to probe defenses more tirelessly than any person, to bring them to light, and governments and companies have been asked to patch in haste. The episode reveals a long human story: much of modern digital life rests on volunteers and modest foundations, and the tools that now expose their weaknesses are arriving faster than the hands that must repair them.
AI-Driven Bug Discovery Strains Volunteer-Run Open-Source Software That Underpins the Web
It often comes down to a handful of volunteers to fix it
Mark
Why did PHP2Shell matter so much, if the bugs had been there for ten years without trouble?
Mimi
Because PHP runs about 70 percent of websites. Government and corporate sites went briefly offline to patch it, and authorities worldwide urged emergency updates.
Mark
And AI found it?
Mimi
Independent experts found it using several advanced AI models. The reporting says humans would have found it too complicated to exploit without that help.
Luke
Worth noting, though, that the source says these flaws were found by defenders. It doesn't report PHP2Shell being exploited in an attack.
Mark
So what's the real strain?
Mimi
Volunteers. Jarek Potiuk at Apache says they have maybe ten times more issues than usual, and humans must check every AI finding for false positives.
Luke
That ten-times figure is his estimate for his own foundation, not an industry measure. The Chrome and Mozilla numbers are separate and come from those companies.
Mark
Is money arriving?
Mimi
Some. Anthropic's Project Glasswing offered $100m in credits, and Alpha-Omega spends about $7m a year. Potiuk still calls the imbalance with corporate wealth highly disproportionate.
Luke
And Peter Slattery says exploitation is a matter of time. That is a forecast, not a confirmed event. What's unknown is how many of those 23,000 vulnerabilities have been fixed.
Le Pouls
- Emergency patches for PHP2Shell flaws were urged on administrators worldwide, briefly taking some government and corporate sites offline.
- Flaws embedded in PHP for over a decade surfaced only when advanced AI models probed defenses no human had the patience to attempt.
- A language running roughly 70 percent of websites is maintained by a foundation operating on a meagre budget and a few volunteers.
- AI-driven discovery is multiplying vulnerability reports across Chrome, Mozilla and Apache projects, swamping maintainers who must still review false positives.
- Corporate credits and scanning programs are flowing in, yet experts warn PHP2Shell may be only the first of many exposed flaws.
Far down the quiet pipes that carry the world's websites, a language begun in 1995 to count visitors to one programmer's résumé has been found to hide flaws that lay unseen for more than a decade. It took artificial intelligence, able to probe defenses more tirelessly than any person, to bring them to light, and governments and companies have been asked to patch in haste. The episode reveals a long human story: much of modern digital life rests on volunteers and modest foundations, and the tools that now expose their weaknesses are arriving faster than the hands that must repair them.
Earlier this month, authorities around the world told website administrators to install emergency updates. A nonprofit programming foundation had flagged critical flaws that could let hackers break into systems, and some government and corporate websites went briefly dark while the fixes were applied. The flaws, nicknamed PHP2Shell, sat inside PHP, the open-source language behind a large share of the web.
They had lain hidden for more than a decade. Independent security experts uncovered them using several advanced AI models, which can attempt far more elaborate ways past security barriers than a person could. Until now, exploiting them was simply too complicated for human effort alone.
PHP began in 1995, when Rasmus Lerdorf wanted to count visitors to his online resume. Generations of volunteers improved it, and today it runs roughly 70 percent of websites. The PHP Foundation, formed in 2021, coordinates its development on a meagre budget. Across open source, the picture is similar: the largest companies depend on this shared infrastructure, yet the groups that maintain it cannot comfortably keep up with what AI now reveals. Amanda Brock of OpenUK said that fixing every known vulnerability is not possible with current resources.
The pressure is visible elsewhere too. Google's latest Chrome update fixed more than 1,000 security bugs, and Mozilla logged over 400 vulnerabilities in a single month. At the Apache Software Foundation, volunteer Jarek Potiuk said his group sees roughly ten times its usual number of issues, and that scanning, token costs and human review now consume enormous time.
Some help is arriving. Anthropic's Project Glasswing offered $100 million in credits and reportedly found over 23,000 vulnerabilities across more than 1,000 open-source projects in a month. Alpha-Omega, backed by several major tech firms, spends about $7 million a year on bug discovery. Potiuk called this real but disproportionate, and suggested companies let staff spend part of their work time maintaining the software they rely on.
The stakes are not theoretical. Log4Shell, found in 2021 without AI, let hackers run code remotely on millions of devices. Researchers at MIT warn that more flaws are being detected and that real-world exploitation is a matter of time. PHP2Shell may be only the first.
Earlier this month, authorities around the world told website administrators to run emergency updates. A nonprofit programming foundation had flagged critical security flaws that could let hackers break into systems. Some government and corporate websites went briefly offline while the patches were applied. The flaws, nicknamed PHP2Shell, sat inside PHP, a widely used open-source web programming language.
The vulnerabilities had been embedded in PHP's code for more than a decade. Independent cybersecurity experts found them using artificial intelligence, specifically several advanced AI models. According to the reporting, they had gone unnoticed because exploiting them would have been too complicated for humans without advanced AI. Those models can mount far more elaborate attempts to get past security barriers than a person could.
PHP began in 1995, when the Danish-Canadian programmer Rasmus Lerdorf wanted to count visitors to his online resume. People around the world improved his software over time, and as with other open-source projects, anyone could download it, modify it and share improvements. Facebook and Wikipedia were built with it. PHP runs about 70 percent of the world's websites. In 2021 the PHP Foundation was launched to coordinate development, and like many foundations of its kind, it works on a meagre budget.
PHP is one piece of a much larger picture. Firefox is open source, as are Perl, Python and JavaScript. Many servers run Apache HTTP Server, maintained by the Apache Software Foundation. Amanda Brock, CEO of the nonprofit OpenUK, said that even proprietary software vendors rely on open source for their digital infrastructure. The largest companies, including Meta, Google, OpenAI and Anthropic, depend on it too. Their own AI tools are now exposing flaws in that infrastructure faster than groups like the PHP Foundation can comfortably handle. Brock said it is not possible, with current resources, to fix all the known vulnerabilities, and that smaller foundations lack hundreds of millions in funding.
The numbers elsewhere point the same way. Google said the latest update to Chrome fixed more than 1,000 security bugs, more than the last two dozen updates combined. Mozilla found more than 400 vulnerabilities in April, after a previous record of 76 the month before. Jarek Potiuk, part of the volunteer security team at the Apache Software Foundation, said his group has perhaps ten times more issues than usual because of AI. He said he has no formal title, in keeping with the foundation's non-hierarchical ethos.
Potiuk described an industry-wide movement to scan software with AI models. The scans cost money, since tokens for the models must be paid for, and humans must then review the results to weed out false positives. Every project and foundation is spending enormous amounts of time on this, he said.
Some corporate money is flowing. Earlier this year Anthropic launched Project Glasswing, offering $100m in credits for its Claude Mythos model to search critical software for flaws. In one month it found more than 23,000 vulnerabilities across more than 1,000 open-source projects. The Apache Software Foundation has used another scheme, Alpha-Omega, to scan the 290 packages it maintains. Backed by companies including Anthropic, Amazon, Google, Microsoft and OpenAI, it spends about $7m a year helping open-source developers find critical bugs. Potiuk said the help is real but the impact is highly disproportionate between the corporate world and the open-source world, given the trillion-dollar valuations of companies whose products depend on free software. He suggested companies could pay staff to spend part of their working hours maintaining the open-source projects they use. When a flaw like PHP2Shell surfaces, he noted, it often falls to a handful of volunteers to fix it.
The stakes were shown in 2021 by Log4Shell, a flaw in a widely used library maintained by the Apache Software Foundation. It let hackers remotely run code on millions of devices, and it was found without AI. Potiuk said cars, microwaves and many internet-connected gadgets were suddenly vulnerable. Peter Slattery, a research scientist at MIT's FutureTech who tracks real-world AI incidents, said his database shows more vulnerabilities being detected, and that it is a matter of time before some are exploited in the real world. Experts say PHP2Shell may be only the first of many such discoveries.
Citations marquantes
We have maybe 10 times more issues than usual because we are using AI to find them.— Jarek Potiuk, Apache Software Foundation volunteer security team
It is a matter of time before some detected vulnerabilities are exploited in the real world.— Peter Slattery, MIT FutureTech (paraphrased)
Envie de l'histoire complète ?
Lire l'original sur Al Jazeera ↗
Technology