AI-found PHP flaws raise questions about internet infrastructure security
Two pieces on the recent PHP security flaws, which led some organisations to take websites offline, look at how AI tools could threaten the systems the internet relies on. One stresses underfunded open-source maintainers, the other says a total internet outage is very unlikely and urges preparation.
1 / 2
The story, neutrally told
Mixed · 2Earlier this month, authorities urged website administrators to install emergency updates after a nonprofit programming foundation flagged critical security flaws in PHP, and some government and corporate websites briefly went offline to patch them. Al JazeeraLC “Government and corporate websites briefly went offline to patch the vulnerabilities, nicknamed PHP2Shell” Read at Al Jazeera ↗ CNAN “A critical vulnerability prompted many organisations to take their websites offline to secure them.” Read at CNA ↗ Mixed · 2PHP is an open-source web programming language that both outlets say runs about 70 percent or more of websites. Al JazeeraLC “which runs about 70 percent of the world’s websites” Read at Al Jazeera ↗ CNAN “supporting more than 70 per cent of the websites we use every day” Read at CNA ↗ Left · 1Al Jazeera reports that the flaws, nicknamed PHP2Shell, were found by independent cybersecurity experts using AI and had sat in the code for more than a decade, because they would have been too complicated for humans to exploit without advanced AI. Al JazeeraLC “The vulnerabilities were embedded in the code of a widely used open-source web programming language, PHP, for more than a decade.” Read at Al Jazeera ↗
Left · 1Experts and maintainers quoted by Al Jazeera say PHP2Shell could be the first of many AI-exposed flaws, and that much critical infrastructure is maintained by volunteers who lack the time and resources to respond. Al JazeeraLC “They say much of the world’s most critical digital infrastructure is maintained by volunteers, who often lack the resources and time to respond to newly discovered threats.” Read at Al Jazeera ↗ Left · 1Other projects report a surge in AI-found bugs: Google said it found more than 1,000 security bugs in its latest Chrome update, Mozilla found more than 400 vulnerabilities in April against a previous record of 76 a month earlier, and Jarek Potiuk of the Apache Software Foundation's volunteer security team said they have about ten times more issues than usual. Al JazeeraLC “Google said it uncovered more than 1,000 security bugs in the last update for its Chrome browser”““We have maybe 10 times more issues than usual because we are using AI to find them,”” Read at Al Jazeera ↗ Left · 1Potiuk said AI scans cost money for model tokens and humans must then review results to weed out false positives, and that corporations that depend on free software should do more, for example by paying staff to maintain open-source projects they use. Al JazeeraLC “But the scans themselves cost money – used to pay for the tokens for AI models – and afterwards, humans must pore over them to weed out false positives.”“major players like Google or Microsoft could, for instance, pay staff to dedicate some of their work hours to maintaining open-source projects they use.” Read at Al Jazeera ↗
Left · 1Funding schemes exist: Anthropic's Project Glasswing offered $100m in credits, and in one month more than 23,000 vulnerabilities were found across more than 1,000 open-source projects, while the Alpha-Omega project, backed by Anthropic, Amazon, Google, Microsoft and OpenAI, spends about $7m a year helping open-source developers find critical bugs. Al JazeeraLC “offering $100m in credits to support its advanced Claude Mythos AI model to search for security vulnerabilities in the world’s critical software”“spends about $7m a year helping open-source developers find critical security bugs” Read at Al Jazeera ↗ Left · 1Peter Slattery of MIT FutureTech said more vulnerabilities are being detected and addressed in time, but also that attacks on a wide range of systems are starting, and that some detected flaws will eventually be exploited in the real world. Al JazeeraLC “it is a matter of time before some are exploited in the real world.” Read at Al Jazeera ↗ Centre · 1In a commentary first published by The Conversation, Mahmoud Elkhodr of CQUniversity Australia says AI tools in the wrong hands can threaten the systems the internet relies on, outpacing many organisations' ability to patch them, and cites the Australian national cybersecurity agency's more than 4,400 notifications about potentially malicious cyber activity in 2025-26, almost 80 per cent more than the previous year. CNAN “The Australian national cybersecurity agency issued more than 4,400 notifications about potentially malicious cyber activity in 2025 to 26, almost 80 per cent more than the previous year.” Read at CNA ↗
Centre · 1Elkhodr argues there is no single switch that turns the internet off and a complete blackout is highly unlikely, but disruption to specific services that share dependencies, such as a common sign-in system, is plausible and likely to increase. CNAN “A complete internet blackout is highly unlikely, given its underlying infrastructure.”“Interruptions to specific services, on the other hand, are both plausible and likely to continue to increase.” Read at CNA ↗ Centre · 1He recommends organisations hold tested incident response plans with clear criteria for isolating systems, and that individuals prepare by keeping offline copies of key documents, a physical card and some cash, alternative sign-in methods and backup multi-factor codes. CNAN “For payments, keep a physical card and a small cash reserve rather than relying entirely on your smartphone wallet.”“a well-prepared and tested incident response plan” Read at CNA ↗
Every sentence links to the reporting it rests on. The pill in front of each says where its sources sit: Left, Centre or Right when one side supplies at least half of them, Mixed when they are evenly split. The number is how many outlets it cites.
Left1 outlet
- Framing
- News feature on how AI-driven vulnerability discovery strains volunteer-run open-source infrastructure, led by the PHP2Shell flaws.
- Emphasis
- Maintainers' limited resources, the surge in AI-found bugs at Chrome, Mozilla and Apache, and the gap between corporate reliance on open source and corporate funding.
- Leaves out or plays down
- Offers little practical advice for ordinary users or businesses on preparing for outages.
- Charged language
- “deluge of security flaws”
- For example
-
“PHP2Shell could be the first in a deluge of security flaws exposed by emerging AI.” — Al Jazeera
“it’s highly disproportional – the impact it has on the corporate world versus the open source world” — Al Jazeera
Centre1 outlet
- Framing
- Academic commentary asking whether the internet could go down, using the PHP incident as an example and reassuring that a full failure is unlikely.
- Emphasis
- Shared dependencies, service-level outages and practical preparation for organisations and users.
- Leaves out or plays down
- Does not mention how the PHP flaws were found, the volunteer-maintainer funding problem or the corporate funding schemes.
- Charged language
- “In the wrong hands”
Right0 outlets
No right outlet in our sources has covered this story yet.
What every side reports
- Recent PHP security flaws led some organisations to take websites offline to patch them.
- PHP runs roughly 70 percent or more of websites.
- AI tools are making it faster to find security flaws, and defenders struggle to patch at the same pace.
Where accounts differ
-
What the main risk is and how to respond
- Left
- Al Jazeera stresses underfunded volunteer open-source maintainers overwhelmed by AI-found flaws and calls for more corporate funding and support.
- Centre
- CNA's commentary stresses that a total internet outage is very unlikely, that service-level disruptions are the real risk, and that organisations and individuals should prepare.
Artificial intelligence topic
Presented in both pieces as a double-edged tool: it finds long-hidden flaws faster than humans, but can outpace defenders' ability to patch, especially if used by attackers.
“In the wrong hands, AI tools can threaten the underlying systems the internet relies on” — CNA
“AI helps to find them, but you have to verify things, you have to review them.” — Al Jazeera
PHP (programming language) product
PHP is described as a widely used open-source language whose critical flaws forced emergency patching, maintained by the nonprofit PHP Foundation on a meagre budget.
“Like many other foundations maintaining open-source software, it operates on a meagre budget.” — Al Jazeera
East and Southeast Asia1 outlet
CNA runs an Australian academic's commentary focused on resilience and personal and organisational preparedness.
“the better we plan for interruptions to online services, the more resilient we can be.” — CNA
CNA
Middle East1 outlet
Al Jazeera frames it as an infrastructure and funding problem rooted in volunteer open-source maintenance.
“When a major security flaw like PHP2Shell is uncovered, it often comes down to a handful of volunteers to fix it.” — Al Jazeera
Al Jazeera
Left1 article
-
Why AI could threaten much of the world’s digital infrastructure
Mixed Feature that warns of a coming wave of AI-found flaws and presses for more corporate support for volunteer open-source maintainers.
Centre1 article
-
CNAN · · Opinion
Commentary: What would happen if the internet went down?
Neutral Explanatory, reassuring commentary that uses the PHP incident to argue outages of specific services are likelier than a full internet failure, and advises preparation.
Right0 articles
No coverage yet.
- 30 Oct 21:59 First CNAN Commentary: What would happen if the internet went down? Opinion
- 30 Oct 23:13 +1h 15m Al JazeeraLC Why AI could threaten much of the world’s digital infrastructure
Times are when each article was published, or when we first saw it if the outlet gave no time.
Ask about this story
Loading…