Two critical security vulnerabilities discovered in PHP, which is used in the infrastructure of a significant portion of websites, have triggered global security warnings. It has become clearer through a statement from OpenAI that artificial intelligence systems played a role in the process of finding these vulnerabilities.
OpenAI announced that its GPT-5.6 Sol model helped identify one of the two critical vulnerabilities in PHP. The cybersecurity company Calif, which is part of the company's "Patch the Planet" initiative, identified the vulnerability in question by utilizing this model. It was also reported that the security firm Wiz independently discovered and reported both vulnerabilities.
The two security vulnerabilities, collectively referred to as "PHP2Shell," can allow attackers to execute malicious code remotely on affected servers. This risk raises the possibility of servers being taken over without a password under certain conditions.
UPDATE WARNING FOR INSTITUTIONS
Following the public disclosure of the vulnerabilities, the US National Security Agency (NSA) called on institutions to quickly implement security updates. In cases where updates cannot be performed immediately, it was advised that affected systems be taken offline. The FBI and authorities in various countries have also issued similar warnings.
Amazon announced that its threat research system, called MadPot, detected attempts to exploit the vulnerabilities before they were publicly disclosed. It was also noted that Google's Wiz team utilized AI tools to examine the vulnerabilities and verify security patches.
OpenAI states that it expects artificial intelligence to be effective in finding more security vulnerabilities in the coming period. For this reason, the company proposes a five-stage framework for managing discovered vulnerabilities, which includes verification, remediation by developers, notification of affected institutions, release of updates, and guidance for users.
According to the company, the primary goal is to close vulnerabilities before they are widely exploited by attackers. However, in software used in numerous products and services like PHP, patching the main software alone may not be sufficient; relevant institutions must also implement the necessary updates in their own systems.
Pointing out that PHP2Shell may not be the last example of such cases, OpenAI reported that there are other significant security vulnerabilities it has already identified and is working to resolve. This picture shows that artificial intelligence will take on a more central role in cybersecurity, both in terms of defense and risk management.
News Source: 12punto
