Websites worldwide compromised by PHP security flaws
A serious security vulnerability in the PHP programming language has set off alarm bells worldwide. Government agencies, hospitals and universities have taken their websites offline as a precaution, while cybercriminals have made millions of attempts to exploit the vulnerabilities. Around 70 percent of the world's websites use PHP. Commentators discuss the role of AI in both detecting and exploiting such security flaws.
A silent threat
The PHP incident shows that large-scale cyber-attacks are by no means the most worrying, The Independent puts in:
“It [AI] is in large part a solution to a problem it also caused. ... And it is banal. Global catastrophes capture our attention, and excite our energy; the gradual weakening of things we depend on engenders boredom, if we even notice at all. Destruction engages us, while degradation quietly depresses us. But that's precisely the danger: the PHP vulnerability and so much like it suggests that AI does indeed threaten the whole world, but in a way so dull and disengaging that we don't even realise.”
AI must not become a means of exerting pressure
The Frankfurter Rundschau sees a dilemma with two possible outcomes:
“Without advanced AI applications, potentially dangerous security vulnerabilities in everyday systems would likely go undetected. ... Either all software vulnerabilities are identified and eliminated by AI, resulting in a period of digital stability. Or only a handful of states and actors will have the technological upper hand in future and will use it as a means of exerting pressure. The question of which AI is the most powerful would become a matter of national security. ... In the case of PHP, internet users – in other words, all of us – might get off lightly. It is to be hoped that the world will unite to fight this new kind of threat together.”
Never-ending race against time
Cybersecurity is increasingly becoming a Sisyphean task because of AI, explains The Economist:
“The PHP bug was announced with 18 hours notice before a patch was released, in an effort to prepare defenders to install the update with alacrity. But an accidental release of a video demonstrating the vulnerability allowed others, AI in hand, to reverse-engineer the problem and work out how to exploit it. ... Defenders once faced the difficult problem of finding the flaws in their own software before attackers did. Now they have a different challenge: with AI exposing a plethora of weaknesses, how can they spread news of the fixes to their users without tipping off their enemies in the process?”