In some ways, the process that uncovered two critical security flaws in the widely used PHP scripting language was a model for how security researchers and AI companies can work together to protect enterprise computing. But at the moment of truth, that process broke down.
Companies around the world scrambled Wednesday to patch the flaws, which could allow attackers to execute code remotely on websites running PHP. By some estimates, that's upwards of 70% of all the sites on the web, and lots of sites chose to go dark in anticipation of the release of the patches just to be safe.
According to the PHP Foundation, the flaws were discovered through OpenAI's Patch the Planet program — which allowed open-source projects like PHP access to its otherwise-gated cybersecurity AI models — back in August by security researchers at Calif, and later verified by OpenAI, Wiz, and another security organizations.
Given the speed at which those modern cybersecurity models can produce exploits for newly discovered flaws, the companies involved attempted to keep the situation under wraps until patches could be available right at the time the flaws were disclosed.
They almost pulled it off.