Hackers got a four-day head start in the PHP2Shell flaw

Hackers got a four-day head start on epic PHP2Shell vulnerability

Hackers got a four-day head start in the PHP2Shell flaw, which could let attackers take over web servers without a password or other login credentials. Researchers at Calif and Wiz found the flaws; Wiz estimates PHP underpins about 70 percent of websites worldwide. OpenAI said Wednesday that, to its knowledge, frontier AI found the flaws before attackers did, and that it worked with PHP, Calif and Wiz to verify them and develop patches.

Why it matters: OpenAI helped verify PHP flaws and build patches for bugs that could let attackers seize web servers without credentials, on infrastructure much of the web relies on.