Global websites face unprecedented PHP security threats as cybercriminals and defenders alike race against time by leveraging artificial intelligence to launch and counter attacks.
Matthew Prince, CEO of global internet infrastructure firm Cloudflare, reported tens of thousands of attack attempts within 45 minutes of the PHP vulnerability disclosure, which quickly surged to hundreds of thousands and eventually millions. The two vulnerabilities disclosed on the 21st (local time) are remote code execution (RCE) flaws that allow unauthorized external hackers to remotely take over servers and execute malicious programs. The volume of attack attempts simply reflects automated scanners probing vulnerable servers, not the actual scale of successful breaches.
Attacks began even before the PHP vulnerabilities were officially disclosed. Amazon revealed on its blog that it detected external attack attempts starting on the 17th, four days before the disclosure. Within hours of the patch release, additional exploit codes emerged and were immediately detected by Amazon’s internal monitoring systems.
AI has become the key variable accelerating these attacks. CJ Moses, Chief Information Security Officer at Amazon, explained that using AI to analyze patch changes or security notices lowers the cost of creating exploit codes. This allows attackers who previously relied on specialized tools built by a few experts to move much faster. He recommended treating critical vulnerabilities in internet-exposed systems on an hourly rather than a daily or monthly patch schedule.
On the defense side, security teams are also using AI to reduce response times. Wiz, a security firm that researched the PHP vulnerability, stated that it utilized Gemini not only for vulnerability discovery but also for attack detection and patch verification. AI is deployed throughout the process to ensure that updates effectively resolve the issues.
AI is also utilized to determine appropriate patches for different enterprises. Google recommended Wiz’s AI agent, ‘Green Agent,’ as a response measure for this PHP incident. This agent customizes vulnerability notices for individual client systems, suggesting correct PHP update versions, proper web firewall settings, and verifying whether execution environments can be safely replaced. The AI assists administrators in navigating notices and finding the right remediation steps for their specific environments.
The process of investigating prior compromises is also automated by AI. Google announced that enterprise customers can use the preview ‘Threat Hunt Agent’ to investigate intrusion traces related to this PHP vulnerability. This AI reviews potential attacks and analyzes security logs, serving to provide evidence supporting suspicious activities rather than just issuing security alerts.
The remaining challenge is translating these tools into real-world applications. In South Korea, the scale of vulnerable systems and the progress of patching remain unassessed. Lee Sang-jung, President of the Korea Internet & Security Agency (KISA), stated during a National Assembly Science, Technology, Information, Broadcasting, and Communications Committee audit on the 23rd that they have yet to track the status of vulnerable PHP versions and patch completion rates. Minister of Science and ICT Bae Kyung-hoon remarked that comprehensive pan-governmental measures and organizational restructuring beyond the National Security Office’s coordination are under review.
