r/technology • u/anonskeptic5 • 6h ago
Security US, allies warn of critical vulnerabilities in programming underlying 70% of the internet
https://www.politico.com/news/2026/10/21/php-cyber-vulnerability-openai-warning-0112905826
u/barriedalenick 5h ago
I am so glad I no longer work in IT
15
9
u/will_dormer 4h ago
You're not the first one I heard to say this but why? It seems like an easy update to PHP?
31
u/AxonBitshift 4h ago
Yes, it is, assuming you are using a version of PHP that is still receiving support. There are millions of website out there running on old unsupported PHP versions with apps that can’t be updated to PHP 8 without breaking things. Those folks have to either take their site offline or spend substantial $ updating then fixing legacy code for PHP 8.
4
1
-13
44
10
5
4
u/Everyone-Chillout 5h ago
I think White Hat/Black Hat best describes the situation... AI can be used for both.
2
u/merRedditor 48m ago
Everyone in software engineering already knows that most of tech is held together with duct tape and luck.
1
u/Captain_N1 27m ago
what we need is the ability to patch out of service systems so we dont have to spend millions on new software that does the same thing. Were is the AI that can patch windows 7? cuse fuck modern windows.
-5
5h ago
[deleted]
18
u/Bupod 5h ago
They did, actually. They discovered this months ago and reported it privately to Php maintainers back in like august. Php foundation actually thanked OpenAI for their cooperation here.
Chainguard was the one that broke the embargo 6 hours early. Calif (which is an OpenAI research partner, but it’s not OpenAI) published a video about it a day early, too.
8
u/ProductIntegortion 5h ago
It was disclosed to PHP and it was disclosed that a patch was coming Thursday, and then the existence of the bug was leaked yesterday followed by proof of concept exploitation. This is all happening today because the normal disclosure and patching system didn't work because of the leak.
-48
u/anonskeptic5 6h ago
This is what we were actually being warned about. AI harming anything on the internet.
67
u/FabianN 5h ago
If you think AI is the problem in this situation, you grossly do not understand the situation.
11
u/SilasTalbot 5h ago
And adversaries are not going to stop, so if commercial AI doesn't find the issues they will be found by China using AI and just never revealed and used for espionage.
Being blanket anti-AI is like being anti-electricity.
Okay...maybe there were advantages of life in the before times, and we're losing some of the things that were part of our shared culture and identity. But, there's no going back.
Resistance is futile. Discomfort is irrelevant. Borg knew what was up.
10
u/MistrFish 5h ago
it's entirely possible that hackers were aware of this exploit for years and already abusing it. AI bringing these types of vulnerabilities to light is a good thing, when handled properly.
5
u/CondiMesmer 4h ago
Don't blame the messenger. The AI is just detecting what already exists. Finding issues and fixing them is a good thing.
1
u/SgathTriallair 1h ago
That isn't even close to what happened.
This is like if someone tells you that your spot shoe is untied and you scream at them for trying to make you trip.
-50
u/musicsoccer 5h ago
Here, AI found the vulnerability before actual people. Something the devs should have done BEFORE releasing. But cuz people are so anti AI, they didnt. Now we're back at square 1.
41
1
u/ithinkitslupis 5h ago
uhh no, an extremely high percentage of devs are still using AI despite people hating it. PHP signed up for Patch the Planet which is a program that uses AI to try to find security vulnerabilities...showing they aren't avoiding using it for security. These bugs are from before AI was this good at finding vulnerabilities and crafting exploits. This was right around the timeframe of coordinated disclosure with a couple early leaks.
-14
u/Ok-Tomorrow-2045 5h ago
But but but… but AI bad!! But I wanted security vulnerabilities to sit unpatched and ready for hackers to take advantage of!!
-35
u/ExistingMulberry3640 5h ago
They warn us now, who the hell created the opportunity for all these vulnerabilities to be there in the first place?
24
u/Professional-Trick14 5h ago
A lack of godlike brain power. It's not possible for a single person working with a million line codebase to understand the ramifications of every modification. LLMs, despite their flaws, can digest and make connections between HUGE amounts of text very easily.
2
1
u/Mountain_rage 5h ago
Some of it is poor training and understaffing, and some are just natural barriers. Humans will typically analyze and understand a technology problem in a different way than AI. AI exploits this natural blind spot, finds and takes advantage. Unfortunately we are now in an arms race of AI vs AI. Maybe it will wipe out the internet snd we can go back to a simpler lifestyle.
-12
-26
u/lordlycrust 5h ago
Fucks sake "the Internet". No, the web.
13
u/rynds1 5h ago
I swear people search this site just to make these “aktchually” comments about pedantic nonsense. It’s so bizarre to me
-23
u/lordlycrust 5h ago
Sounds like a you problem I'm all for accuracy in reporting.
9
u/rynds1 5h ago
Yes, we all know you’re a genius now. Thanks for your contribution to journalism
-12
u/lordlycrust 5h ago
Next time I'll be sure to obtain your permission before I comment. Thanks for your contribution to nothing, ever.
5
u/rynds1 5h ago
Just keep it to yourself next time, no need to ask for my permission
-2
u/lordlycrust 5h ago
You're absolutely right, there's no need for anyone to ask your permission for anything.
7
u/rynds1 5h ago
Yup, that’s exactly what I said. You brought up the permissions thing and it’s a little weird.
-2
u/lordlycrust 5h ago
Ok mate. If it helps you to sleep at night.
7
u/rynds1 5h ago
You just have to have the last word don’t you? Lol
Aren’t there people you should be correcting right now? For all you know someone could be calling the web the internet.. imagine the horror!
→ More replies
-9
u/davesr25 5h ago
Well I guess there are going to be lots of people working out what can be done with decompiling soon enough.
If it works for gaming what else will it work with ?
175
u/Soupdeloup 5h ago
Initial handful of comments on this post are incredibly ignorant of how the world of programming works. As far as I can tell from the release, AI didn't cause this issue, it just helped find it.
No language or framework is 100% secure and it's immensely better for it to be caught ahead of time with AI than to just sit exposed for who knows how long, with new things constantly added on top of and around it.