Commentary: PHP vulnerabilities - why the good guys have notched a victory in AI-cybersecurity age

NEW YORK: The headlines were unremarkable. Researchers had found a way to weaponise two vulnerabilities in PHP, a programming language used for websites and apps, and companies were being urged on Wednesday (Oct 21) to install a patch. 

A smattering of websites and services were taken offline while it was installed. The US said it was looking into government systems and expediting mitigations. The media barely blinked.

But like a thwarted terror attack, or the Year 2000 problem, the general feeling of a nothingburger can disguise the behind-the-scenes heroics that have - so far - averted catastrophe. 

That’s the case here: an incident that should be considered the most significant victory for the good guys so far in the new AI-cybersecurity age, a boon for the cybersecurity industry eager to prove it’s more valuable than ever.
 

SEVERE VULNERABILITIES FOUND

The vulnerabilities - named PHP2Shell - stood to affect around “70 per cent of all websites in the world,” according to Wiz, a cybersecurity firm owned by Google. 

These deep, underlying flaws, which had existed for more than a decade, allowed an attacker to execute code remotely - like handing a set of keys to an outsider to do and see almost anything it wanted. “These findings rank among the most severe vulnerabilities discovered in PHP,” Wiz wrote, “and arguably in software history”.

An abundance of caution has gone global. 

Websites belonging to several European governments and local authorities went offline. In the UK, the BBC took parts of its website down for maintenance. A US-based human-resources company briefly went offline. Japan’s Prime Minister Sanae Takaichi urged companies to apply the patch quickly. 

Yet so far, that’s all this has amounted to: an abundance of caution.

PHP2Shell was discovered in August with the help of “frontier” AI models, the term given to the cutting edge of what’s coming out of the leading labs, from OpenAI to Google. 

Wiz found the vulnerability in August. So, separately, did Calif, another cybersecurity firm, working with OpenAI as part of a coordinated effort called Patch the Planet, which was launched in the wake of fear around how AI could supercharge the capabilities of cybercriminals and rogue states.

To be clear, this was a far more complex task than simply asking the AI model to find a problem. 

Rather, this was a concert of model and human specialists, allowing what Wiz described as “an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve”. A single researcher in Wiz’s team handled in a week what would’ve taken a “world-class” team months, the firm said.

IMPORTANCE OF SPECIALISED CYBERSCURITY FIRMS

With the flaws discovered, the mitigation effort kicked in behind closed doors. The team that administers PHP - it’s an open-source language - began developing its fix. Top internet infrastructure firms such as Amazon Web Services and Cloudflare were notified. 

The vulnerabilities (and the solution) were made public on Wednesday, with a patch released in the morning - a day ahead of schedule because some details had been leaked. OpenAI put out a “skill” for its Codex platform that helps companies quickly determine which updates are needed.

Now that the exploit has been made public, hackers will be identifying those weak spots, too, and some have already done so. 

Dane Knecht, chief technology officer at Cloudflare, said the company had, before the patch was made available, seen “early attacks emerging” against its clients and was offering them stopgap measures until the weakness had been patched. These attacks are nothing compared with what might have happened had these vulnerabilities been discovered by bad actors first.

The incident underscores the growing importance of specialised cybersecurity firms in the AI age. It was only in February that the stocks of leading security companies like Cloudflare and Crowdstrike took a bath over investor fears that AI lab Anthropic was going to steal their business. 

What nonsense that seems today, with the opposite proving true.

The new paradigm of security threats has made cybersecurity expertise more valuable, so it’s no surprise that Cloudflare shares rose around 7 per cent on the news, up 76 per cent since that February shock. Crowdstrike is up 146 per cent in that time.

Of course, the AI firms are helping defend against a risk they helped create, but that cat’s out of the bag now - the same technology that can discover new drugs or write complex code can be used to hack computers. The only course of action is to deal with it. 

This incident should provide encouragement. The takeaway is that a collaboration between security researchers and frontier AI labs gave the world a head start against a serious threat. These collaborative efforts must continue and be expanded.

We’re not out of the woods yet. As ever in cybersecurity, the onus is still on security teams to act.

But these teams do so in full possession of the facts, with a patch ready to go, and in a state of relative calm thanks to trusted sources offering well-considered remedies. The fact that none of this made it to the front pages or nightly news bulletins counts as a battle won in what will be a never-ending war.