A vulnerability found with AI help
Cybersecurity leaders are raising alarms after researchers used artificial intelligence to uncover a major vulnerability this week, and they expect AI tools to reveal deeper weaknesses in global internet infrastructure in the months ahead. The period has been dubbed Black October, a reference to critical flaws found in a coding language that underpins millions of websites and may have gone unpatched for years.[S1][S2]
The flaws were located in PHP, a programming language that powers a vast share of the web. Some specialists estimated that as many as 70% of all internet sites were exposed to hacking as a result. Researchers at the AI security platform Wiz described the discovery as one of the most serious vulnerabilities ever found in PHP and possibly in the history of software.[S1]
According to Wiz, the underlying defects had existed for decades, but proving they could be exploited demanded an unusually intricate sequence of steps that sat at the limit of what human researchers could realistically carry out. That complexity is central to why the find is being treated as a turning point.[S1]
Executives predict a vulnerability tsunami
Technology executives are warning that AI will be used both to locate and to weaponize security holes on a scale and at a speed never seen before. Jason Clinton, Anthropic's deputy chief information security officer, forecast a vulnerability tsunami in the coming months and argued there would not be enough time to patch critical infrastructure. Salesforce chief executive Marc Benioff called the situation a code red.[S1]
Sam Altman has abandoned the view that all software bugs can eventually be fixed, adding his voice to a widening group of industry leaders. Matthew Prince, who heads Cloudflare, argued that AI locates and flags security weaknesses at a speed and in a manner that will seem catastrophic, since defenders will not be able to keep up. He forecast that the coming two years would be exceptionally turbulent, as new tools with endless patience comb the internet for vulnerabilities.[S1]
Exploitation begins as agencies respond
Concern is not limited to finding bugs. Attempts to exploit the PHP vulnerability have already started. After the flaws were disclosed, government and private websites across the United States and the United Kingdom briefly took their sites offline to apply patches. The US National Security Agency issued an alert urging any site running PHP to install the fixes without delay.[S1]
The NSA cautioned that hostile actors might exploit the flaws to gain unauthorized access to servers, potentially enabling them to steal confidential information, take services offline or extend their reach within a network. Prince reported that Cloudflare logged thousands of attempts to abuse the PHP vulnerabilities during the 10 hours preceding the announcement. According to him, that count climbed to tens of thousands 45 minutes after disclosure, hundreds of thousands within two hours, and millions by the time of his post.[S1]
