The AI-Hacking Apocalypse Began Last Night

The internet could be on the verge of a total meltdown.

Yesterday, someone posted to a public forum that two major security flaws had been found in a programming language that undergirds the web.

The language, called PHP, is used by as much as 70 percent of websites.

In order to protect themselves from hackers, a number of government, hospital, and school websites across Europe went dark this morning.

The organization that maintains PHP quickly confirmed they were preparing to announce two major vulnerabilities alongside patches for them.

Both weaknesses, officially disclosed today, appear to have existed in PHP for more than a decade, but were only just discovered with the use of AI tools.

Hackers have already been detected trying to exploit them, likely with the help of AI, and implementing the fixes to address the vulnerabilities could take companies days or weeks.

In the meantime, tens of millions of exposed servers, databases, and devices are exposed.

“PHP is one of the fundamental pieces of technology that supports the internet,” Sam Rubin, a senior vice president at the cybersecurity firm Palo Alto Networks, told me.

As of now, the websites of the Finnish health agency, the Port of Rotterdam, the Paris police force, 4Chan, and an unknown number of others are all down while they address the PHP vulnerabilities. [ Read:How long until AI hacks everything? ] News of these weaknesses in PHP is the capstone in a weeks-long slew of devastating, AI-powered cybersecurity events.

In recent weeks, criminals and state-backed attackers have used AI to hack into more than 100 companies, including John Deere and SharkNinja; to automate hacks on some 400 financial institutions in Latin America; and to steal hundreds of thousands of credit-card records from two companies.

Since this summer, attackers have hit governments, data centers, and hospitals in Ukraine, Russia, Argentina, Bangladesh, and Indonesia.

Also today, the developers of Node—a platform used by nearly half of software developers—disclosed multiple high-severity vulnerabilities.

And that’s the abridged list.