Inside the Race to Contain 'Internet Chaos'

What happened

Security researchers found two serious bugs in PHP, a language that powers many web servers. The bugs, named PHP2Shell, let attackers run unauthorized software on any web server that has not been fixed. Calif Research, a US security startup with many Vietnamese team members, was the first to find one of them. Experts worked together in an unofficial group to build patches before the flaws became widely known.

Key numbers and facts

• Two flaws were found, both named PHP2Shell.
• Some attacks could take only a few seconds on small systems, and hours on complex ones.
• Fixing the problem meant changing nearly 200 files.
• Developers wrote more than 10,000 lines of code during the work.
• The planned patch release date was October 22, but the flaw became public on October 21.

Why AI matters here

Researchers used AI models from OpenAI and Google to find the flaws. According to Calif Research, this kind of flaw had hidden in PHP code for years because it was very hard to exploit. AI helped find a way. Experts compare the risk to Heartbleed, a 2014 flaw that forced the world to protect hundreds of thousands of servers.

Why it matters

Many websites run PHP, so an unpatched server can be taken over by attackers. If hackers learn how to use the flaw before fixes are installed, the damage could spread fast. The story shows how AI can help both defenders and attackers find weak points in software.

What to watch

• Whether website owners install the patches quickly.
• Whether hackers use AI to build attacks from the public details.
• How security teams and AI companies share bugs before they are made public.