AI Goes Vulnerability Hunting
This week a couple big security incidents rocked the world. First, a critical vulnerability was found in the core PHP engine (the language that runs 70% of the internet basically!). The vulnerability discovered essentially allows an attacker to take over a web server without logging in. And even worse - this vulnerability had been around for YEARS. In addition to this, LiteLLM (open source library a lot of the ecosystem uses to route model calls) was compromised. A malicious version of LiteLLM was (in the background) harvesting credentials from anyone who used it.
We all know that common libraries and code have vulnerabilities. But they’re just hard for humans to find. AI can scan everything incredibly quickly and spot things humans can’t. These two (PHP and LiteLLM) are just the first of many to come.
PHP is a server side scripting language that’s been around since the mid 90’s. It’s what runs behind the scenes on a web server, taking requests from the browser and sending back the page. PHP runs about 70% of the websites in the world, and it’s what WordPress, Drupal, software behind Wikipedia, etc. For the particular vulnerability discovered, not only can attackers now execute code on the servers, they can also read live memory from the PHP process (meaning passwords, auth tokens, API keys belonging to other people’s requests, etc) are all at risk.
The NSA even told organizations to patch things immediately or take their servers offline! One other crazy fact about this vulnerability - a limited version of it was actually discovered back in 2024, but it was written off as “too hard to exploit.” Not anymore… Now, the world discovered a vulnerability living in the engine that runs the internet that has existed for the last 14 years…
So how does a 14 year old vulnerability all of a sudden become “critical”? Earlier this summer the PHP Foundation partnered with OpenAI’s “Patch the Planet” program to audit PHP with OpenAI’s latest security models (they did this with the Calif team). The Calif team probably expected to find nothing (given PHP is arguably one of the most picked over code bases on earth, what hacker hasn’t tried to exploit it!). They then used the latest models, and found the vulnerability! This is maybe getting to much in the weeds, but with the help of Claude:
“The hard part was never spotting the bug. The hard part was chaining several memory bugs together and adapting the exploit to each target’s memory layout - tedious, specialist work that nobody ever bothered to finish. But models don’t get bored.”
The models accomplished in a short amount of time what would have taken humans months (or longer) even if the humans knew what they were supposed to be looking for in the first place! Then, behind the scenes, PHP wrote the fix while OpenAI pulled in industry leaders like $Cloudflare, Inc.(NET)$ , $Amazon.com(AMZN)$ AWS, $Alphabet(GOOG)$ $Microsoft(MSFT)$, etc to prep mitigations ahead of disclosing the vulnerability publicly.
Security vulnerabilities generally come in three different types
-
Known
-
Unknown
-
Known but too hard to exploit
The reality is there’s a good amount of the internet that has historically lived “safely” in that third bucket. But not anymore. Bugs that were historically impractical to exploit and now very viable targets (and even worst, they’re known targets you can goal seek a model to break!). In the case of the PHP exploit, maybe we got lucky - a “defender” actor got there before an attacker.
OpenAI has also said that they have several more significant vulnerabilities in their queue, and that it expects findings like this to increase in the coming months.
Here’s a practical takeaway for founders. What we know is happening in the background is GOOD actors from OpenAI / Anthropic are working to find these vulnerabilities, and develop patches in the background. As soon as they have the patches ready, they’ll make public announcements about the exploit and the patch, and then it will be on EVERY company to make sure they apply the patch as quickly as possible. So having playbooks / frameworks / tools to implement patches as quickly as possible will become incredibly important.
Final thought - the patch for the PHP vulnerability is for versions later than 8.1. For versions 8.1 or older - there’s no patch currently (I don’t believe). Not good!
Markets are always moving - and sometimes, the best move is knowing what works for you.
With Treasury yields, oil prices and rate expectations keeping markets on edge this week, investors are once again thinking carefully about where to position next. There’s no one-size-fits-all choice in investing — and the same goes for Tiger Merch. This month’s hot picks are in, featuring the Tiger Toiletry Bag, Universal Travel Adapter, Tiger Umbrella and more favourites chosen by fellow Tigers.
Explore the Monthly Hot Picks in Tiger Coin Mall, now 12% OFF for a limited time.
Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.
