AI Uncovers PHP Vulnerability Hidden for Years: A Double-Edged Sword for Offense and Defense, Cloud Security and Patch Management Emerge as Investment Themes

Zhitong Finance APP has learned that the widely used open-source programming language PHP has been exposed to two critical vulnerabilities, "PHP2Shell," which could allow hackers to remotely execute malicious code and expose sensitive data. The vulnerabilities lay dormant for years and were only discovered with the help of AI. PHP developers released emergency fixes on Wednesday and urged users to update immediately. Cloudflare's CEO said that before the vulnerability disclosure, thousands of exploitation attempts had already appeared across the internet, surging to tens of thousands within 45 minutes of the announcement, reaching hundreds of thousands within two hours, and now totaling millions. Government websites in Europe and elsewhere went offline, and Japan's Mitsubishi UFJ Financial Group and the Japanese Ministry of Finance suspended some services. The U.S. National Security Agency and the Federal Bureau of Investigation issued warnings, with Google, OpenAI, and Amazon participating in vulnerability discovery and protection. The incident highlights the double-edged-sword effect of AI in attack and defense as well as the systemic risks of open-source software.