Earlier this month, authorities worldwide urged website administrators to execute emergency updates after a nonprofit programming foundation flagged critical security flaws that could allow hackers to breach systems. Government and corporate websites briefly went offline to patch the vulnerabilities, nicknamed PHP2Shell, which were discovered by independent cybersecurity experts using artificial intelligence (AI). The vulnerabilities were embedded in the code of a widely used open-source web programming language, PHP, for more than a decade.
They had gone unnoticed, however, because it would have been too complicated for humans to exploit them without the use of advanced AI. But cybersecurity experts, as well as those maintaining important software, say PHP2Shell could be the first in a deluge of security flaws exposed by emerging AI. They say much of the world’s most critical digital infrastructure is maintained by volunteers, who often lack the resources and time to respond to newly discovered threats.
PHP got its start in 1995, when Danish-Canadian programmer Rasmus Lerdorf sought to track how many people visited his online resume. Over time, others around the world improved Lerdorf’s software, and it grew in popularity. As with other open-source coding projects, anyone could download, modify and share improvements.
Websites like Facebook and Wikipedia were built using PHP, which runs about 70 percent of the world’s websites. In 2021, a dedicated nonprofit, the PHP Foundation, was launched to coordinate development. Like many other foundations maintaining open-source software, it operates on a meagre budget.
Most of the digital infrastructure consumers use is powered by open source software. The Mozilla Firefox browser is open source, as are languages like Perl, Python, and JavaScript. The software that lets a computer communicate with others on the internet is often open source, with many servers using products like Apache HTTP Server, maintained by the Apache Software Foundation.
The world’s largest corporations, like Meta, Google, OpenAI and Anthropic, depend on that volunteer-built, open-source infrastructure. Now, those companies’ own AI tools are uncovering security flaws in the infrastructure at a pace that needs far more resources for groups like the PHP Foundation to keep up. Developers of other software are also discovering far more security flaws than in the past because AI is being used to probe defences.
Extract — continue reading at the source.
