AI boosts cybersecurity threat detection after PHP vulnerability emerges

Cybersecurity organizations increasingly rely on artificial intelligence (AI) to spot vulnerabilities and conduct threat analyses, and the role of AI in identifying risks and patching affected code was further cemented by the recent discovery of the “PHP2Shell” vulnerability.

The PHP vulnerability, classified as a high-severity threat with a score of 9.2 out of 10 on the Common Vulnerability Scoring System (CVSS), allowed attackers to compromise web servers by executing code remotely.

Kubra Kalkan Cakmakci, an associate professor of computer engineering at Istanbul-based Ozyegin University, told Anadolu that AI accelerates software debugging and helps evaluate millions of potential errors simultaneously.

“AI was able to analyze multiple layers quickly at the same time when detecting the PHP2Shell vulnerability, while humans can only work on and think through few steps at a time,” she said.

“Ensuring cybersecurity against vulnerabilities requires a holistic approach addressing all layers, and organizations must have solutions in place for critical security breaches,” she added.

Fatih Sensoy, a senior security researcher at cybersecurity firm Kaspersky, told Anadolu that the PHP vulnerability, which put many websites and platforms under maintenance, could expose plain-text session data and other sensitive information, such as credit card details.

“Storing personal data in an encrypted format on a separate database on the server could add a few extra security mechanisms, but once a frequently used website falls into the hands of the attacker, everything from that point on is at their mercy,” he said.

Sensoy stated that AI does not identify such vulnerabilities on its own, noting that initiatives like Patch the Planet have human experts guide the technology to potential weak spots.

“An update is released to patch the vulnerability, but developing a patch could take up to two to three days, but in cybersecurity, even an hour is crucial — anonymous attackers are also on the lookout for these updates with the sole objective of figuring out how to exploit a disclosed vulnerability,” he said.

“Such vulnerabilities emerged before, and they are being disclosed now, and continue to be disclosed in the future — when we face such incidents, we should have rapid response solutions in place to minimize the damage,” he added.