Artificial intelligence is triggering a cybersecurity crisis. The creators of a technology called PHP, which powers up to 70% of the world's websites, disclosed a security issue Wednesday that could allow hackers to steal information or launch attacks on users of a hacked website.
AI tools helped find what is turning out to be one of the most severe online bugs ever -- and cyber experts are racing to patch it before hackers use AI to exploit it.
Here's what PHP is and what happens next.
What is PHP?
PHP is a programming language, created more than 30 years ago, that at one point was nearly everywhere on the Web to pull data from back-end servers and build dynamic webpages. PHP isn't as popular as it once was, but it is still very widely used. Because it has been around so long, security experts say that it is sometimes buried so deeply in corporate networks that some organizations don't even realize they are using it.
Who uses it?
By some estimates, as much as 70% of the web uses PHP. It is popular with government websites and small businesses, and it can be found in WordPress and in major websites such as Wikipedia.
Is there a bug?
In August, security researchers found a way to take control over a server running PHP by sending it a series of malicious requests. On a small PHP server this could be done in seconds with just a few dozen requests. This could give a way for a hacker to take over a website and steal data from the website or to install malicious software that would try to hack the site's visitors.
What is happening now?
Patches were released on Wednesday and there is now a worldwide rush to patch everything. On Wednesday, many website operators simply shut down their sites, rather than run the risk of being hacked. The imageboard 4chan shut down comments for fear that it would be hacked. Webmasters with the Dutch and Belgian governments simply pulled the plug on websites, and the U.S. National Security Agency and the Federal Bureau of Investigation issued warnings: "These risks are serious enough to require immediate patching across United States Government departments and agencies," the NSA wrote.
Why is everybody freaking out?
In a word: artificial intelligence. The security world deals with these five-alarm fires around ubiquitous software every decade or so, but this is the first time one has happened since AI tools became so good at hacking. Using these tools, hackers are already claiming to have discovered ways of exploiting the PHP bugs. And to make matters worse, technical details about the security issue leaked out ahead of the patches, giving the bad guys an early tip-off. Amazon, which runs internet infrastructure, said it saw the first signs of these bugs being exploited on Oct. 17 -- four days before the patches were released.
This explanatory article may be periodically updated.
Comments