AI Uncovers Long-Dormant PHP Vulnerability: Double-Edged Sword in Attack and Defense Highlights Cloud Security and Patch Management as Key Investment Themes

Title context: AI Uncovers Long-Dormant PHP Vulnerability: Double-Edged Sword in Attack and Defense Highlights Cloud Security and Patch Management as Key Investment Themes Text: The widely used open-source programming language PHP has been found to contain two critical vulnerabilities collectively dubbed "PHP2Shell," which could allow hackers to remotely execute malicious code and expose sensitive data. The vulnerabilities lay dormant for years until they were discovered with the help of AI. PHP developers released emergency fixes on Wednesday and urged users to update immediately. Cloudflare's CEO said that before the disclosure, thousands of exploitation attempts had already appeared across the internet within 10 hours, surging to tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours, and now millions. Government websites in Europe and elsewhere went offline, and Japan's Mitsubishi UFJ Financial Group and the Japanese Ministry of Finance suspended some services. The U.S. National Security Agency and the Federal Bureau of Investigation issued warnings, while Google, OpenAI, and Amazon participated in vulnerability discovery and protection. The incident highlights the double-edged-sword effect of AI in attack and defense as well as the systemic risks of open-source software. PHP Vulnerability Dormant for Years Uncovered by AI, Global Emergency Patching Underway According to comprehensive foreign media reports, the widely used open-source programming language PHP has been found to contain two critical vulnerabilities collectively known as "PHP2Shell." The vulnerabilities could allow hackers to remotely execute malicious code and potentially expose sensitive server data. PHP developers released emergency fixes on Wednesday, saying the vulnerabilities had lain dormant for years until they were discovered with the help of artificial intelligence, and "encouraged" all users to update immediately. Google, OpenAI, and Amazon all participated in vulnerability discovery, attack detection, or system protection. The U.S. National Security Agency urged organizations using PHP to prepare security updates, warning that the vulnerabilities could give attackers direct access to server file systems and databases; if immediate updates are not possible, it recommended taking affected systems offline. The Federal Bureau of Investigation also warned that malicious actors could exploit the vulnerabilities to execute code remotely. Cloudflare CEO Matthew Prince said in a post on X on Wednesday night that in the 10 hours before the vulnerabilities were publicly disclosed, thousands of exploitation attempts had already appeared across the internet; within 45 minutes of the announcement, that number surged to tens of thousands, reached hundreds of thousands within two hours, and has now reached millions. Amazon said its MadPot threat detection system had detected exploitation attempts before the vulnerabilities were publicly disclosed, but it was not yet clear how attackers obtained the information in advance. Analysts noted that the interval between disclosure and large-scale exploitation is rapidly shrinking, challenging the traditional "disclose first, patch later" emergency response rhythm. Global Response: Government Websites Offline, Financial Institutions Suspend Some Services Government websites in Europe and other regions went offline on Wednesday, and website operators worldwide rushed to secure their systems. Japan's Mitsubishi UFJ Financial Group said it had temporarily suspended some internet services as an emergency measure; the Japanese Ministry of Finance temporarily suspended some website content and services while implementing security measures; Japanese Prime Minister Sanae Takaichi urged website owners to check whether they use PHP and prepare to apply fixes. Cloudflare said it had deployed protection against PHP2Shell through its Web Application Firewall. Google said its Wiz cybersecurity unit used AI models to discover and investigate the vulnerabilities, with Gemini helping assess the vulnerabilities, test attack paths, and verify fixes; OpenAI said researchers used its AI models to help discover the vulnerabilities, coordinating fixes and preparing protective measures over the past two months. Market participants believe the incident will, in the short term, reinforce corporate spending expectations in areas such as cloud security, Web application firewalls, threat intelligence, and patch management, and that attention to the cybersecurity sector is likely to increase. In the medium to long term, AI is changing the efficiency of vulnerability discovery, but similar capabilities could also be exploited by cybercriminals, lowering the barrier to attack. For investors, the systemic risks brought by the widespread use of open-source software make corporate patch management and emergency response capabilities important indicators of operational resilience; for regulators, critical infrastructure's reliance on open-source components may drive stricter disclosure and protection requirements. The incident once again shows that "AI security" is moving from concept to rigid expenditure, and open-source governance will also become an important variable in valuation and risk assessment.