Binance heist, Anthropic attack expose PHP memory flaw's remote control risk

The evidence

Around 400,000 CVEs have been officially logged since 1988, according to the published report The publication identifies a specific issue in PHP, the language used by roughly 70% of websites, as a key example of current threats.reported Cybersecurity firms Calif and Wiz independently rediscovered bugs related to how host computers access memory while applications run.Fast Company cites 13,000 monthly severe CVEs and a PHP memory corruption issue as evidence of escalating systemic risk. If a malicious actor forces an out-of-memory condition, they may interrupt the runtime and leave a partially initialized object behind. The application might then treat this object as valid, creating a stepping stone for hostile server takeover. A separate bug could allow instructions from a request to be read again instead of being reset. Fast Company notes that if attackers can execute these actions, they gain remote control over the host computer.

The decision

The outlet frames generative AI companies like Anthropic and OpenAI as central to this dynamic. Fast Company argues these firms empower hackers while positioning themselves as the sole line of defense. The publication suggests they have found a niche resembling a protection racket. This perspective is supported by recent incidents involving these companies and others. Anthropic narrowly avoided a major attack via a third-party extension that would have allowed worm uploads. Binance suffered what is currently the largest cryptocurrency heist in history. Additionally, the Spanish travel-tech company Amadeus was hacked, leaking customer information for several major airlines.

What to make of it

Fast Company states that payment information was not leaked in the Amadeus incident. The outlet describes the PHP bug as akin to discovering that millions of buildings share the same faulty lock. This analogy implies that intruders could gain easy access if the lock is picked. Websites such as Wikimedia preemptively went offline until a fix was pushed through. The severity of the threat depends on whether an attacker can actually perform the memory manipulation steps. If successful, the threat is described as apocalyptic for the affected machine.

In practice

Startups relying on PHP-based infrastructure should note that roughly 70% of websites use this language, according to the published report The reported PHP flaws require forcing an out-of-memory condition to exploit the primary bug.reported This means the vulnerability is not automatically exploitable by simple requests but requires specific resource exhaustion techniques. Founders should monitor whether their hosting environments are affected by the memory management issues identified by Calif and Wiz. While no immediate fix status is confirmed for all PHP implementations, some sites like Wikimedia took preemptive offline measures. Users of AI tools from Anthropic and OpenAI should be aware of the reported risks associated with third-party extensions, which nearly facilitated a worm upload attack.reported