r/Foodforthought • u/cnn • 4d ago
Analysis: The biggest-ever internet security threat has been known for 22 years. AI made it a crisis in 2 days
https://www.cnn.com/2026/10/23/tech/ai-cybersecurity-php2shell-explained?Date=20261024&Profile=cnn&utm_content=1792804748&utm_medium=social&utm_source=reddit_user74
u/cnn 4d ago
Analysis:
In July 2004, security researcher
A critical flaw in PHP, the programming language that powers 70% of the world’s websites, could allow an attacker to do some seriously nefarious stuff: read passwords, steal databases or even take over entire websites.
But Esser’s warning went mostly ignored for decades. In 2020, another researcher discovered a related problem, and the PHP overseers issued a partial fix. A similar PHP vulnerability was uncovered in 2024 – but was left unfixed.
Why was one of the most severe threats to the foundation of the internet left unresolved for 22 years?
Because it would have taken mind-numbing work for a human to figure out how to take advantage of it: tedious, time-consuming, monotonous coding. That rendered the PHP vulnerability impractical to exploit.
AI just figured out how to do it in two days.
On Wednesday,
Phew, you might think. The good guys got to it first. But the AI-assisted discovery deeply concerned cybersecurity researchers, because the next one might come from someone who wants to weaponize it.
And AI doesn’t care who’s pulling the trigger.
36
12
u/billdietrich1 3d ago
Why was one of the most severe threats to the foundation of the internet left unresolved for 22 years?
Because it would have taken mind-numbing work for a human to figure out how to take advantage of it: tedious, time-consuming, monotonous coding. That rendered the PHP vulnerability impractical to exploit.
This excuse sounds bogus to me. They had known
2
2
u/redrightreturning 3d ago
What if we didn’t train AI to hack shit?
What if we trained AI to be conscientious, honest, and compassionate?
This story to me sounds like someone repeatedly punching themselves in the face and then complaining that their nose is broken. Tech researchers did this to themselves.
9
u/AwTomorrow 3d ago
Us the public have next to no say what idiots in charge will train their AI to do, is basically the issue.
There needs to be a lot more
and government limitations rather than just techbros running blindly in every direction then crying when stuff blows up in their face international cooperation 3
u/redrightreturning 3d ago
10000% agree.
I also wish media would be more vocally critical. So many institutions with power to affect change are complicit in this.
3
u/neuronexmachina 3d ago
Are you talking about the AIs used by the people who collaborated with the PHP Foundation to identify and fix the vulnerability, or the AIs without safety limits that are used by hackers to mass-exploit production systems? They're generally not made by the same people.
2
u/billdietrich1 3d ago
What if we didn’t train AI to hack shit?
And "we" includes hackers, nation-state actors, Chinese companies, users of open-source models ? They're all going to agree to use AI only for nice things ?
1
u/elperroborrachotoo 2d ago
on top of that, AI bros want AI to be inevitable, otherwise no one's going to pay the bills.
1
1
u/conception 2d ago
I see CNN has given up on having humans write copy. Alas. The end of an era for humanity.
1
u/AutoModerator 4d ago
This is a sub for civil discussion and exchange of ideas
Participants who engage in name-calling or blatant antagonism will be permanently removed.
If you encounter any noxious actors in the sub please use the Report button.
This sticky is on every post. No additional cautions will be provided.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.