ast week's discovery of the widespread PHP vulnerabilities may only be the beginning of a new class of exploits.
OpenAI's discovery of critical vulnerabilities in PHP, the open-source programming language used by an estimated 70% of websites, sent shockwaves throughout the AI and cybersecurity communities, resulting in the FBI stepping in to encourage organizations to quickly patch their sites. However, these vulnerabilities aren't new exploits, but holes that existed for more than a decade.
What's concerning about this incident isn't that these vulnerabilities existed in the first place, but rather the fact that they can now actually be taken advantage of, Rich Campagna, SVP of Network Security Products at Palo Alto Networks, told The Deep View. To put it plainly, AI's cyber capabilities have opened up a door that allows previously overlooked vulnerabilities to be exploited, he said.
"In this particular case, these were vulnerabilities that apparently have been known for more than two decades, but were deemed unexploitable," said Campagna. "We can no longer have this situation where weaknesses that are known to exist can be assumed to be non-exploitable."
Given that PHP extends to nearly "every internet-facing web asset on the planet," Campagna said, these vulnerabilities were a "shock to the system" for organizations that AI may force many to take security more seriously. That shift can be seen in two ways:
- For one, vulnerabilities can no longer be dismissed or deemed non-exploitable, no matter the size of your organization. Security by obscurity, or assuming that you aren't going to be a target because of your organization's small scale, isn't an option anymore. "If a [hacker] is just after the profit motive … automatically everyone becomes a target," he said.
- Additionally, the window to fix vulnerabilities is rapidly shrinking, he said. This is what OpenAI has called the "defender's window," or the amount of time that an organization has to find and fix vulnerabilities before bad actors do. Time is a luxury that enterprises no longer have, said Campagna. Crowdstrike has reported thatexploit time has shrunk to hours and is advocating that the patch window shrink from 30 days to 30 minutes.
Though the rapidly advancing nature of AI may leave organizations struggling to play catch-up, Campagna said that the advantage could eventually shift back to cyber defenders. In order for that to happen, however, enterprises and organizations need to embed AI into the software development lifecycle (SDLC) from the jump, limiting as many vulnerabilities as possible from making it into the hands of the customer.
"You're using the same tool the attacker could potentially use to find and then fix vulnerabilities before the attacker even has their hands on the software that previously had that vulnerability," said Campagna. "Look for these things before they ship, and get the leg up on the attacker."
Our Deeper View #
Though AI presents both the problem and the solution, the issue isn't about the technology itself, but rather with the organizations that are being forced to reckon with it. Though large scale enterprises in critical industries like finance, healthcare and infrastructure are more likely to take these kinds of risks seriously, the PHP vulnerabilities revealed the sheer scale of the problem, impacting any organization with an internet presence. And with AI driving down the cost curve for hackers, smaller, less resourced organizations and businesses may be the most vulnerable simply because they don't understand the gravity of the risks, or may not have the resources or expertise to properly defend themselves.