Zoe Kleinman, who edits technology and AI coverage for the BBC, described the PHP story as “the cyber equivalent of an unexploded bomb” — and noted she had never seen such a dramatic, public and global response to a cyber event that has not happened yet.
How it was found
Cyber security researcher Ryan Austin, who has worked on PHP security for twenty years, told BBC Radio 4 he discovered the flaw. He called it “the most serious vulnerability I’ve ever found”, and said it “started with a hunch that I would not have been able to scratch without AI”.
That sentence is the whole story in miniature. The weaknesses had been resting quietly in PHP for years and are not easy to exploit — one researcher told Kleinman he had been up all night trying to do it as an experiment and was finding it very difficult. But things that are very difficult for humans are increasingly very little trouble for a machine.
Prothom Alo, citing Al Jazeera, credits the security firms Calif and Wiz with finding the two flaws using AI-assisted tools. The accounts differ in whom they name; they agree on the method.
Then the embargo broke
The fix was meant to stay quiet until everyone had a chance to patch. The news leaked, and from that point the clock was running.
Professor Alan Woodward of Surrey University named the bind: “How do you alert people they need to be ready, and then that a patch is urgently required, whilst not alerting attackers? Basically you’re telling everyone about the problem at the same time and hoping the defenders aren’t awake enough to act as soon as the patch is out.”
Amazon said its threat intelligence system identified that it had been targeted, with further exploitation attempts once the embargo lifted, and that it automatically detected and restricted malicious scanning. Cloudflare and Palo Alto Networks report millions of attempts. As things stand there are no reports that anyone has succeeded.
Two readings of the same week
Gina Neff, Professor of Responsible AI at Queen Mary University, called it a good news story: a team supported by a large AI company used AI to find the problem, worked for months to solve it, and got everybody ready. “We have enormous capability to handle these risks.”
The counter-reading is in the same facts. The defenders had AI and months; the attackers have the same tools and the disclosure gave them a starting gun. Less than two months ago a hundred technology companies published an open letter urging the world to adopt a new level of cyber resilience for the age of AI. Nobody had to wait long to find out what they meant.
What it means for a small country
The part that does not travel is the response capacity. Britain’s NCSC, its EU and Australian counterparts and the US agencies all issued coordinated guidance within hours, and large hosts patched at scale before most customers knew anything had happened.
Bangladesh has a national CIRT, but no equivalent reflex for pushing an emergency patch through thousands of small hosting resellers and the agencies that built their clients’ sites years ago and moved on. The useful lesson from this week is not about PHP. It is that the gap between a global advisory and a patched server in Dhaka is measured in weeks, and attackers read the same advisory on day one.
