AI security scans test open-source maintenance capacity
AI-assisted scans have exposed long-standing PHP flaws and a growing volume of reported vulnerabilities, raising questions about whether volunteer-led projects have the resources to address them.
Emergency updates followed the discovery of PHP2Shell vulnerabilities, which had been present in PHP code for more than a decade. Al Jazeera reports that independent cybersecurity experts used advanced AI models to identify the flaws, prompting temporary outages at some government and corporate websites. The report does not identify the affected sites or confirm any exploitation.
The case highlights a capacity problem for the open-source projects that underpin much of the internet. PHP is estimated to run about 70 per cent of websites, and the PHP Foundation, established in 2021 to coordinate its development, operates on a limited budget.
Other projects are reporting sharp increases in vulnerabilities found through AI-assisted scans. Google said its latest Chrome update addressed more than 1,000 security bugs, while Mozilla reported more than 400 vulnerabilities in April, up from a previous monthly record of 76. An Apache Software Foundation volunteer said his team was seeing about 10 times more issues than usual with AI use.
Anthropic’s Project Glasswing reportedly found more than 23,000 vulnerabilities across more than 1,000 open-source projects in one month. Such counts still require human review: Apache volunteer Jarek Potiuk said teams must check findings for false positives, a process that takes time and funding.
OpenUK chief executive Amanda Brock said smaller foundations lack the resources to manage vulnerabilities at the pace AI tools are identifying them. Open-source advocates argue that companies whose products depend on this software should provide more support, including staff time for maintenance. Existing schemes help fund scanning and remediation, but maintainers say corporate backing remains insufficient.
