Websites scramble to fix software flaw that could put much of internet at risk
The issue, called php2shell, concerns technology that handles website memory when processing queries from a computer.
A programming language used in as much as 70% of websites on the internet has a critical security issue that could allow attackers to take control of or disrupt systems using it, a research firm said Wednesday.
The scope and scale of the bug is all the more remarkable for the way it was found: by security researchers with the assistance of artificial intelligence tools.
The issue was so severe that National Security Agency’s Cybersecurity Collaboration Center advised websites that could not immediately fix the issue Wednesday morning to go temporarily offline, amid fears that hackers could use AI to rapidly exploit gaps in the system.
The issue, called php2shell, concerns technology that handles website memory when processing queries from a computer. It was disclosed Wednesday morning after the nonprofit foundation that maintains the tool had a chance to fix the vulnerability.
For the past six months, the cybersecurity world has been racing to use new advanced AI models to find computer bugs and fix them before they can be found and exploited by hackers.
The best cyber models from AI companies, including OpenAI, are strictly controlled and only vetted cyber and tech companies have access. But in the past month, new Chinese AI models that are nearly as capable have become freely available for anyone to download.
AI has already been used in multiple high-impact hacks. Earlier this month, a South Korean bank had detailed customer information stolen by a China-based hacker, who cybersecurity analysts said appeared to be an amateur who used AI tools to execute the attack.
The php2shell bug was found as part of an initiative run by OpenAI to help security researchers find internet vulnerabilities with cutting-edge AI tools. (The Washington Post has a content partnership with OpenAI.) The vulnerability, named after the programming language PHP, was identified by researchers with the firm Calif.
“Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory,” OpenAI said in a statement. “It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits.”
The company also hinted that it had found several more significant vulnerabilities that are in the process of being fixed.
Calif, the research firm that identified the vulnerability, said in a blog post that it had not expected to find any critical issues when it examined PHP, the programming language, because many people had done “extensive AI assisted audits of this target.” But after a few days of looking, the firm managed to piece together a version of the vulnerability. Calif began reporting the bug to be fixed in August.
Cloudflare, a majority internet security provider, said it has deployed protections against the vulnerability, enabling sites to keep running. WordPress, another major platform, also urged site owners to immediately update their applications.
