AI reveals old software flaws

Serious flaws in software code have been increasingly exposed due to the use of artificial intelligence, overwhelming teams responsible for code reviews. AI tools are now capable of identifying complex errors that were previously difficult to detect manually.

PHP project faces security incident

The open source PHP project, which powers approximately 70% of the global web, recently faced a security incident attributed to such flaws. The PHP2Shell vulnerabilities, present in the code for over 10 years, were identified through the use of advanced AI models that automated the discovery and chaining of complex software errors.

Resource shortage hinders response

The PHP Foundation, which relies on a single full-time employee and 14 part-time contributors, has acknowledged a structural failure due to a lack of resources. The PHP2Shell flaws were initially reported by a developer in 2024 but were not prioritized due to limited time for analysis.

Vulnerabilities stem from memory management

These vulnerabilities are related to memory management in the C language, the language in which the PHP interpreter is written. Memory management errors can allow attackers to execute arbitrary code or cause system crashes, making them particularly dangerous.

Security updates released

The PHP project has released security updates addressing the two critical "PHP2Shell" vulnerabilities. Users of platforms such as WordPress.com, WordPress VIP, Pressable, Tumblr, and other Automattic infrastructure are already protected.

Broader trend of software crises

The PHP case is part of a broader trend of software supply chain crises. Similar issues have been seen with the HeartBleed flaw, which exposed global encryption keys, and the Log4j project, maintained by a small group of volunteers.

XZ Utils highlights open source risks

The XZ Utils case also highlighted the vulnerability of open source projects to malicious infiltration, particularly when maintainers are isolated and overburdened. These incidents underscore the risks of relying on under-resourced open source projects for critical infrastructure.

Experts call for systemic change

Experts and security agencies such as CISA and ANSSI emphasize the need for urgent transformations in how private companies and governments use open source software. Funding entities like the PHP Foundation and participation in subsidy programs such as the Sovereign Tech Fund must become mandatory security investments.

AI's dual role in security

The incident demonstrates that AI can accelerate the discovery of hidden flaws, but without sufficient human resources to address them, cybercriminals could exploit the same technology for attacks. This highlights the need for a balanced approach to AI and human oversight in cybersecurity.

Europe moves toward stricter regulations

The Cyber Resilience Act (CRA) in Europe is expected to enforce stricter regulations on the use of open-source code, requiring audits and legal responsibility for its lifecycle. This legislation aims to ensure that open source software is as secure as proprietary alternatives.