Rush is on to patch AI-discovered software vulnerability that could impact 70% of websites worldwide
Governments and corporations worked throughout the night to update software after the AI-assisted discovery of vulnerabilities in a programming language vital to about 70% of websites globally
LONDON -- Governments and corporations worked throughout the night on urgent security updates after the AI-assisted discovery of vulnerabilities in a programming language vital to 70% of websites globally.
Many government sites appeared to be functioning normally Thursday, but outages or limited service continued while security work was under way.
The FBI’s cyber division warned on Wednesday that the vulnerabilities could allow malicious actors to remotely execute code in the programming language, PHP, which powers websites and web applications. That raised the risk of sensitive data and networks being compromised, said the agency, which recommended that operators take websites offline if they can’t update them immediately.
In Britain some “limited” government services may temporarily be offline while work is carried out to address potential cybersecurity issues, the prime minister’s office said.
“Work has already taken place across Government to identify and fix potential exposures to our systems, and our experts are continuing to work closely with both OpenAI and international partners on this issue,” a spokeswoman said Thursday.
“No large public-facing critical services are being affected by the exercise, but some limited services may temporarily be offline while security work is carried out, the spokeswoman said.
The two critical flaws identified by AI could allow bad actors to get unauthenticated access to sites which, in theory, could allow them to control a web server remotely without needing a password, said James Sullivan, Director of Cyber and Tech at the Royal United Services Institute in London. That could allow a hacker to steal data, alter data or use the system as a platform from which to launch other attacks, he said.
Taking websites offline while fixing the problem is “good practice,” and appropriate cyber risk management but it's “staggering” that some of the flaws are more than a decade old, Sullivan said.
Artificial intelligence agents helped uncover the vulnerabilities. In a blog post, OpenAI said it had led a coalition of researchers, security providers and others to address vulnerabilities in PHP over the past two months.
OpenAI called the flaws “one of the most impactful security issues in recent memory.” It said AI appeared to find the vulnerabilities before any attackers did.
“There's good news and bad news to this,” Sullivan said, explaining that on the one hand, AI can help attackers to identify new vulnerabilities but, on the other hand, it can also help uncover and fix them.
The reason, he said, that some websites may still be down is because there are multiple patches available for different types of software, some organizations may still be waiting to receive them and they need to be tested to make sure they work.
The government of Finland’s website said that the disruption had been resolved, but that “some content is still missing and is currently being restored.”
In Japan, Osaka prefecture’s website said its machine translations service was “unavailable due to a system failure.”
The Japanese Prime Minister shared a warning from the government in a social media post, advising website administrators to check if they use PHP and to immediately install a patch that was released late Wednesday.
“If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk,” Prime Minister Sanae Takaichi said.
Chief Cabinet Secretary Minoru Kihara said the government had not received any reports of damage from cyberattacks related to the PHP vulnerability. Parts of some government websites were taken offline temporarily, he said, to minimize risks, “Just to be safe,” Kihara said.
One of the vulnerabilities corrupts a system's memory which means it can no longer remember certain bits of data, allowing a potential hacker to exploit the system with its own code. The other flaw means user data is stored on the system instead of being removed which allows a bad actor to potentially access it, including downloading or wiping it, Sullivan said.
The PHP Foundation, which includes developers who work on securing the programming language, said late Wednesday that it had released fixes for the vulnerabilities, along with instructions on how to update systems.
The European Union cybersecurity agency, ENISA, advised “organizations to take immediate action” to address the vulnerabilities.
“We shouldn’t turn this into a futuristic scenario where we’re all doomed,” said Sullivan.
There are many “basic” steps individuals and companies can take to protect themselves against most threats, he said, including identifying systems that could be compromised, installing software updates and patches as soon as they are released and using two-factor authentication.
Popular Reads
ABC News Live