Choose Rich Live
Tech

AI-discovered PHP vulnerabilities trigger global patch scramble and breach warnings

Critical vulnerabilities uncovered in PHP using artificial intelligence tools have touched off a global security scramble, prompting cybersecurity leaders to warn of impending breaches across unpatched servers and devices.

CrowdStrike CEO George Kurtz speaking during a CNBC broadcast reporting on critical software vulnerabilities.
Image: @coinbureau

Security researchers used artificial intelligence tools to detect critical, years-old flaws in PHP, the scripting language powering roughly 70% of the web, according to reports from WIRED and The New Stack. Following the discovery, AI-assisted attacks began targeting systems, prompting CNBC to describe the fallout as a global security scramble dubbed AI's Black October. Developing a fix for the underlying vulnerabilities required two months.[1][3][4]

In a CNBC interview, CrowdStrike chief executive George Kurtz warned that the industry will see a lot of breaches in the coming months as a consequence. Kurtz noted that exploiting the nearly 20-year-old vulnerabilities had remained theoretical until AI demonstrated exploitability, putting tens of millions of servers at risk by allowing attackers to execute commands on vulnerable web servers. He urged administrators to accelerate remediations, saying, "You need to be looking at your watch, not a calendar."[2][5][6][7]

While Kurtz said modern PHP installations and major corporate networks will likely be patched quickly, he warned of severe exposure among legacy equipment. He cautioned that older routers and firewalls running outdated PHP installations will never receive patches, creating a persistent long tail of vulnerable internet-connected hardware.[2]

Key facts

  • Security researchers used AI tools to uncover years-old vulnerabilities in the PHP scripting language, followed by AI-assisted attacks.
  • The affected PHP code powers approximately 70% of the web, and developing the fix took two months.
  • CrowdStrike CEO George Kurtz warned on CNBC that the flaws will lead to many breaches in the coming months.
  • Kurtz stated that exploiting the nearly 20-year-old flaws was only theoretical until AI proved it was possible, putting tens of millions of servers at risk.
  • The vulnerabilities enable attackers to run commands on vulnerable web servers.
  • Older firewalls and routers operating on outdated PHP will never be patched, according to Kurtz.

Sources · 7 sources

  1. CN

    CNBC@CNBCPost on X ·

    AI's 'Black October': Critical PHP flaws set off global security scramble https://t.co/3ucpb5jqLl

    Open source
  2. CB

    Coin Bureau@coinbureauPost on X ·

    🚨CrowdStrike CEO urges fast patching after AI proved the PHP flaws can be exploited, putting tens of millions of servers at risk. George Kurtz says exploiting the almost 20-year-old flaws was only "theoretical" until AI proved it could be done. That has forced everyone into a "very quick patch cycle." PHP is the language that "drives the internet," and the flaws let attackers run commands on vulnerable web servers. Kurtz says large companies will patch their systems and modern PHP versions will get patched, though some older versions may not. What people aren't talking about enough, he says, is old routers and firewalls running outdated PHP that "will never be patched." He warns that long tail will lead to "a lot of breaches" in the coming months. "You need to be looking at your watch, not a calendar."

    Open source
  3. TN

    The New Stack@thenewstackPost on X ·

    AI found flaws in the code behind 70% of the web. The fix took two months. https://t.co/9kWikod4B9

    Open source
  4. WI

    WIRED@WIREDPost on X ·

    Security researchers used AI tools to help uncover years-old vulnerabilities in the PHP web scripting language. Then the AI-assisted attacks began. https://t.co/vXCnOafgwU

    Open source
  5. SB

    Shay Boloor@StockSavvyShayPost on X ·

    $CRWD CEO warns “you’re going to see a lot of breaches happening in the coming months” following the discovery of critical PHP security flaws. CrowdStrike’s massive threat data could become an even bigger advantage with AI now finding vulnerabilities humans missed for decades. https://t.co/hyGWWHo33U

    Open source
  6. *B

    *Walter Bloomberg@DeItaonePost on X ·

    CROWDSTRIKE CEO GEORGE KURTZ: WILL SEE A LOT OF BREACHES IN COMING MONTHS FROM PHP VULNERABILITY - CNBC INTERVIEW

    Open source
  7. EV

    Evan@StockMKTNewzPost on X ·

    CROWDSTRIKE'S $CRWD CEO GEORGE KURTZ JUST SAID ON CNBC: WILL SEE A LOT OF BREACHES IN COMING MONTHS FROM PHP VULNERABILITY

    Open source