This week companies and government agencies rushed to install patches for two critical vulnerabilities in PHP, a programming language that powers a significant share of websites worldwide. AFP reports this.
The holes through which attackers could target websites were discovered with the help of a powerful OpenAI model. This is one of the most high-profile examples of how artificial intelligence is making itself felt in cybersecurity.
The agency spoke with Michael Daniel, president of the Cyber Threat Alliance and former White House cybersecurity coordinator under President Barack Obama. He explained what this case means at a time when AI tools are finding software bugs faster than ever.
"This is the beginning of a rather chaotic period, given the capabilities of advanced models," Daniel said. "I have said for years that the logical consequence of such models' ability to find vulnerabilities quickly and at large scale is a flood of these vulnerabilities."
He recalled a phrase from Rob Joyce, former director of cybersecurity at the US National Security Agency: "the great cleansing wildfire of old software." According to Daniel, it is also "our technical debt, and the payment date has come due." Companies and agencies have put off updating software for years to save money. Such expenses are not visible in the books, but in reality they exist - they simply remain hidden for a time.
What should organizations do? Daniel advises preparing for updates, keeping them current and promptly installing patches as soon as they are released. "There will be a flood of vulnerabilities, a flood of patches and a flood of protective measures, and not all of them will be equally good," he warns. Small organizations that lack their own resources need to restructure their work so as to accept updates from vendors as quickly as possible.
Is every hole found dangerous? According to the expert, historically the share of vulnerabilities that attackers actually exploit is 5-6%, and there are no signs that this figure is growing. However, now, if an attacker takes up the task, they act far faster. Previously, months passed from the appearance of a proof of concept (a demonstration that a vulnerability can be exploited) to inclusion in exploit kits (attack tools); now it takes hours or days.
Large companies have a harder time. Previously they tried not to take any risks at all: before deploying a patch, it was thoroughly tested. Now there is no time for that. "If the risk of breaking something when installing a patch is 1%, and the risk of an attack could cost 50 million dollars, then that is an interesting trade-off," Daniel explains.
Are advanced AI models reliable at finding real bugs? "A lot of noise," he replies. "The PHP case is a clear example of a real vulnerability, but around it there is a mass of false ones or ones relating to programs that are not connected to the internet at all. We need to improve the sorting system."
What will happen in two or three years? Daniel hopes that AI tools will begin to be applied to programs even before they are released. Then perhaps we will start producing software that is less vulnerable from the outset. "You burn out all the old, and that frees up space for new growth that is more secure from the very start. This does not solve the cybersecurity problem, but it changes its nature."