New cybersecurity threats leveraging artificial intelligence (AI) are exposing critical, decade-old vulnerabilities in PHP, the open-source web programming language that powers approximately 70 percent of the world's websites. These flaws, recently dubbed PHP2Shell, were discovered by independent cybersecurity experts using AI, a development that has prompted urgent updates from authorities worldwide.

PHP, which began as a personal project in 1995 to track website visitors, has evolved into a foundational element of global digital infrastructure. Its open-source nature allows widespread adoption and modification, with major platforms like Facebook and Wikipedia having been built using it. However, the complexity of the PHP2Shell vulnerabilities meant they remained hidden for over a decade, inaccessible to human exploitation without advanced AI tools.

This discovery signals a potential wave of new security threats, as AI capabilities now allow for the identification and exploitation of previously undetectable flaws. Cybersecurity experts and software maintainers are concerned that much of the world's critical digital infrastructure relies on volunteer-driven, open-source projects that often operate with limited resources to combat sophisticated, AI-enhanced attacks.

Peter Slattery, a research scientist at MIT’s FutureTech, noted that the AI safety community has long predicted that such harmful impacts of AI would first manifest in cybersecurity. "There’s been a lot of people in the AI safety community that said this is one of the first areas where we are going to see the harmful impact of AI," Slattery stated, referencing his research into how cybersecurity professionals are adapting to new AI technologies.

The PHP Foundation, established in 2021 to coordinate development efforts, operates on a modest budget, mirroring the financial constraints faced by many organizations maintaining vital open-source software. This limited funding presents a significant challenge in keeping pace with evolving threats, particularly those amplified by AI.

Beyond PHP, a vast array of essential digital services depend on open-source software. This includes web browsers like Mozilla Firefox, programming languages such as Perl, Python, and JavaScript, and server software like the Apache HTTP Server. The underlying protocols that enable internet communication are also frequently built on open-source solutions.

The discovery of PHP2Shell highlights a critical asymmetry: AI is increasingly empowering attackers to find vulnerabilities that are too complex for human analysis alone, while the maintainers of the infrastructure often lack the resources to proactively defend against such advanced threats.

As AI technology continues to advance, the potential for it to uncover and exploit a wider range of hidden flaws in open-source systems raises significant questions about the future security of the internet and the global digital economy. The reliance on volunteer efforts for core infrastructure, while historically a strength, may become a critical vulnerability in the face of AI-driven cyber warfare.