IT professor: 'I've bet a beer that we'll see a similar case within five years'
AI has turbocharged how efficiently serious errors in critical code can be detected, says a professor.
IT staff have been working hard worldwide on Wednesday because an update in the programming language PHP had to be implemented quickly to close a security flaw. Archive photo. (Photo: © Annegret Hilse, Reuters/Ritzau Scanpix) 59 minutes ago.
As early as Tuesday, rumors began to circulate in various online forums and on social media.
Two security flaws had been located in the widespread programming language PHP - and thus a potential door was open for hackers to numerous websites worldwide.
On Wednesday, the organization PHP Foundation released an update to close those holes, but in the meantime, the news had caused companies and governments worldwide to shut down websites to prevent unauthorized access until the holes were closed.
But how were the security holes actually discovered? The PHP Foundation, the organization behind the programming language PHP, has itself described this in a blog post.
-----------------------------------
What is PHP and programming languages?
-----------------------------------
* PHP is what is called a programming language.
* It is thus one of several 'languages' that software developers can use when writing code. And all websites and all software are built from code.
* PHP is one of the oldest programming languages and was first launched in 1995.
* Although several programming languages have emerged since, PHP is still one of the most widespread and thus drives large parts of the internet.
* PHP is a fundamental building block in large parts of the internet. It is used in widespread systems like WordPress, Drupal, and Joomla, and in a large number of webshops, intranets, customer portals, and booking systems.
Sources: NOS and Danish Industry
--------------------
First discovered in 2024
--------------------
The issue - or at least indications of it - was first located in 2024 during a review of PHP's codebase.
- PHP itself writes that at the time they had limited resources to fix it. And it was difficult to do anything about it without having a very large impact on users, explains Jens Myrup Pedersen, professor of cybersecurity at Aarhus University.
Therefore, they let it lie. And they probably regret that today.
- We are not going to pretend: The delay was a structural error, the PHP Foundation states in the blog post on Wednesday.
Also read: Aula temporarily closed after possible security risk
---------------------
Gigantic amount of code
---------------------
In 2026, the PHP Foundation then started a new review of its codebase, this time using AI - including language models from the companies OpenAI and Anthropic. Here they found the same vulnerability in the system.
- Fixing something like that can take a very long time because the software runs on many systems and is used in many ways. So you have to be sure that the systems continue to work with an update, so you don't end up with a lot of crashes - or open up new vulnerabilities, explains Jens Myrup Pedersen.
The article continues below the image.
Websites worldwide have been closed on Wednesday, including French government websites. (Photo: © Annegret Hilse, Reuters/Ritzau Scanpix)
PHP has a gigantic codebase.
According to Reuters, the programming language is used on 70 percent of all websites whose programming language can be identified. It is also the driving engine in the software WordPress, which powers about 40 percent of all websites - everything from blogs, company websites, government portals, online shops, and news sites.
Therefore, it can probably best be described like this: It was easier for AI to find the error, quite simply because it is easier for artificial intelligence to find a needle in a haystack than it is for a human.
-------------------------------
Hackers can use the same tool
-------------------------------
AI - including technology developed by the company OpenAI - has turbocharged how quickly flaws like PHP's security breaches can be located. (Photo: © Pau Barrena, AFP/Ritzau Scanpix)
Jens Myrup Pedersen points out that it is good that AI can be used to solve this type of problem, while of course it was unfortunate that the vulnerability in the codebase had crept in in the first place.
- But on the other hand, hackers can also use AI as a tool - and can also find vulnerabilities faster and easier than before, he says.
Regardless, AI has turbocharged how quickly flaws like PHP's security breach can be located.
- I've bet a beer with another journalist that it won't be five years before we see a case like this again, says Jens Myrup Pedersen.
Warning: This article was translated by a Large Language Model, in case of doubt, you can always visit the original source.