Rob Ricci on Nostr: Later in the day, the PHP foundation, which is responsible for the PHP language that ...

Later in the day, the PHP foundation, which is responsible for the PHP language that runs a *large* part of the web (estimates on how much vary) announced that they were going to drop a patch for a security vulnerability that affected every single version of PHP going back decades.

Under a common way of scoring the severity of vulnerabilities, this one got a 9.2. Out of 10.

So.

If you don't work in security, you might wonder: why tell us that they were going to release a patch, instead of just releasing it?

Well, once you release the patch, people can start trying to figure out what it fixed. And once they do that, well, they can start developing exploits, and using them.

And this is where, however many words I am into this post, I finally say: "AI"

Based on what we *think* we know now about the vulnerability (-ies, plural, as it turns out), they are somewhat complex to exploit. A few years ago, we would have *probably* assumed that it was going to take a while to make an exploit. In fact, that's *exactly* what happened: a few years ago, apparently, the potential for this vulnerability was noticed, but people didn't, at the time, figure out how to exploit it, so they considered it hypothetical and didn't prioritize fixing it. Recently, it was re-discovered, and an exploit found, with the assistance of an LLM.

But today, the assumption is: once the patch was out there, people would use LLMs to develop exploits, and this would happen *fast*.

The current state of the world is that bots scraping web pages to collect training data for LLMs are *ubiquitous* and *relentless*. My research group has had to battle them many times in the last few months, and we haven't "won," we've just kept the load on our servers to a level where they're still usable for their *actual* purpose. It seems very likely that some of these bots are run by people malicious enough to turn them into botnets that start exploiting this new vulnerability.

So, the current best practice is: let the OS vendors, big companies, clouds, etc. know, so they can start making packages for people to update to. Announce a time, give everyone a little while to get ready.