AI-Discovered PHP Vulnerabilities Trigger Global Website Shutdowns and Cybersecurity Crisis

Thumbnail Image

The information displayed in the AIM should not be reported as representing the official views of the OECD or of its member countries.

AI models used by cybersecurity firms discovered two critical PHP vulnerabilities affecting about 70% of global websites. The flaws allowed attackers to take over servers without passwords, prompting emergency shutdowns of government and enterprise sites worldwide. State-backed hackers, notably from China, exploited AI tools for attacks, escalating the crisis.[AI generated]

Why's our monitor labelling this an incident or hazard?

The event explicitly involves AI systems (AI models used by cybersecurity companies) in discovering critical security vulnerabilities in PHP. These vulnerabilities have led to immediate and widespread harm, including the shutdown of government and enterprise websites, which disrupts critical infrastructure and services. The harm is realized and significant, with potential for attackers to take over servers without passwords. The AI's role in discovering these vulnerabilities is pivotal to the incident, as it accelerated the identification of these severe security flaws. The event is not merely a potential risk but an ongoing incident with direct harm and disruption, thus qualifying as an AI Incident rather than an AI Hazard or Complementary Information.[AI generated]
AI principles
Robustness & digital securitySafety
Industries
Digital security
Affected stakeholders
GovernmentBusiness
Harm types
Economic/PropertyReputationalPublic interest
Business function:
ICT management and information security
AI system task:
Event/anomaly detection

Articles about this incident or hazard