Loading page…
Michael Daniel says companies may need to accept more risk from updates as attackers move faster. The PHP response shows why finding a flaw is only the beginning.
Listen to this story
The PHP flaws can enable unauthenticated code execution on servers; the project says all PHP installations serving web requests are at risk, with greatest danger in Apache’s mod_php setup. OpenAI says GPT-5.6 Sol helped identify one flaw, while Wiz independently found and reported both during a two-month coordinated effort. The episode sharpens the operational tradeoff Michael Daniel describes: attackers may adopt exploits within hours or days, so organizations need faster patching and better triage. OpenAI says it knows of no attacker discovery before defenders, but that assessment is not a guarantee.
PHP’s October 21 advisory recommends updating supported releases to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
PHP 8.1 and earlier no longer receive project updates; some vendors backport fixes, but temporary mitigations are not a complete solution.
Daniel says exploit adoption that once took months can now take hours or days; he sees no evidence the historical 5%–6% exploitation rate is rising.
Companies may no longer have time for exhaustive security-update testing before attackers move, Cyber Threat Alliance president Michael Daniel warned in an AFP interview published October 25. His warning follows a rush by businesses and government agencies to patch two critical PHP flaws, including one discovered with help from an OpenAI model.
Daniel, a former White House cybersecurity coordinator, describes the episode as accumulated software-maintenance costs becoming unavoidable. Organizations have incentives to keep old software running, he said, while its security risks remain an implicit cost rather than a visible expense. AI-assisted discovery threatens to bring those costs forward.
PHP’s October 21 security advisory describes two vulnerabilities that can let an attacker run code on a server without logging in. It identifies all PHP installations serving web requests as at risk. The project considers the danger highest for Apache’s mod_php setup, where a demonstrated attack can run before the website’s own application code starts.
Both flaws involve PHP mishandling its internal request data. One can leave data only partly initialized when memory runs out, then treat it as valid during cleanup. The other lets internal state outlive the memory backing it, so a later request handled by the same worker can use stale data.
OpenAI’s account credits Calif with identifying a critical flaw using GPT-5.6 Sol through its Patch the Planet initiative. It separately credits Wiz with independently discovering and reporting both vulnerabilities. PHP’s maintainers led the fixes and release, with OpenAI, Wiz, Cloudflare and other partners providing research, technical support and coordination.
OpenAI said the coordinated response took place over two months. Work included testing fixes, preparing protections with infrastructure providers and engaging government cyber agencies. The company says, to its knowledge, frontier AI found the vulnerabilities before attackers did, giving defenders time to prepare ahead of disclosure. That is OpenAI’s assessment, not a guarantee against prior exploitation.
The project also published temporary measures for specific attack paths, but warns that these do not make an installation safe. Only an update is a complete solution.
There's going to be a flood of vulnerabilities, a flood of patches and a flood of mitigations, and not all of them will be created equal.
Michael Daniel, Cyber Threat Alliance president, speaking to AFP
Daniel distinguishes the speed of attacks from the share of flaws attackers use. He puts the historical exploitation rate at 5% to 6%, with no indication it is rising. But the progression from a disclosed flaw to a demonstration attack and then criminal attack-tool adoption, once measured in months, can now happen in hours or days, he said.
That changes the calculation for large businesses. Daniel said companies historically tested patches extensively because they had almost no tolerance for breaking production systems. Now, they must weigh the chance that an update disrupts operations against the potential cost of being attacked. His example contrasts a hypothetical 1% breakage risk with a possible $50 million attack.
For smaller organizations without much internal security capacity, his advice is to prepare to accept vendor updates as quickly as possible, rather than assume they can independently manage every finding and mitigation.
Moving faster does not mean treating every AI-generated finding as an emergency. Daniel called PHP a real vulnerability case, but said many other findings are either false or concern software that is not exposed to the internet. He argues that the system for sorting and prioritizing those reports needs to improve.
His longer-term hope is to apply AI tools before software is deployed, reducing the vulnerabilities shipped in the first place. He does not present that as an end to cybersecurity problems: it would change their nature, after a difficult period of dealing with flaws in existing software.
Loading discussion...
Join the conversation
Explain when faster protection should outweigh the risk of disruption.
Be the first to share a perspective or an experience.
Reader comments
Newest comments first. Replies stay oldest first.