AI found obscure PHP bugs, but human leak sparked disclosure debate

An AI tool recently identified obscure flaws in the PHP programming language, but the subsequent controversy stems from premature disclosure rather than the detection method itself, according to letters published by The Guardian.reported

The claim

Reader David Gibson stated that the bugs found by the AI tool had been present in PHP for a long time without anybody noticing them. He described the vulnerabilities as extremely obscure and noted they were not discovered by hackers. Instead, an AI tool was used to check the PHP source code, which Gibson characterized as a good use of artificial intelligence.

The response

Gibson argued that the real problem arose when someone, presumably a human and not an AI, leaked details about the bugs before they had a chance to be fixed. He suggested that if this action is not already illegal, it should be made so with sufficient penalties to deter others. This perspective directly addresses concerns about premature disclosure raised in earlier reporting.

What the evidence means

The material leaves the legal status of such leaks uncertain, with Gibson proposing new laws rather than citing existing ones. It also highlights a broader concern from reader Charles MacKinnon, who expressed disquiet about society being at the mercy of technological systems that citizens neither understand nor requested, comparing the situation to a real version of Y2K.reported

In practice

For enterprise IT buyers, the key takeaway is that AI tools can effectively audit source code for obscure vulnerabilities that human reviewers might miss. However, the incident underscores the critical importance of coordinated disclosure processes.