Stay informed with free updates
Simply register at Cybersecurity myFT Digest – delivered straight to your inbox.
The U.S. National Security Agency warned Wednesday that vulnerabilities in a programming language that underpins the Internet, discovered using AI tools, have exposed websites around the world to critical hacking risks.
The warning from the intelligence agency, as well as British authorities, came as some European governments reportedly took websites offline while they patched the two security flaws.
The far-reaching impact of bugs, discovered using OpenAI and Google models after remaining undetected for more than a decade, highlights AI’s ability to disrupt cybersecurity.
The release earlier this year of new models from Anthropic and OpenAI with powerful cyber capabilities prompted warnings from politicians and financial regulators and led the U.S. government to temporarily limit their deployment.
The NSA on Wednesday warned all organizations using the programming language known as PHP to immediately update their systems or take them offline.
Developers responsible for maintaining PHP released software updates on Wednesday to fix the vulnerabilities.
“These vulnerabilities often provide a direct path to the server’s file system or database,” the NSA said. “If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated. »
Researchers from two American cybersecurity groups, Calif and Wiz, discovered the vulnerabilities. Wiz, owned by Alphabet, estimates that the compromised programming language powers about 70% of all websites worldwide.
“Given the severity of these flaws and the widespread use of PHP, we consider this to be one of the most significant security issues in recent memory,” OpenAI said Wednesday. “To our knowledge, Frontier AI discovered these vulnerabilities before the attackers. »
“This shows how AI can uncover security vulnerabilities with Internet-wide impact, but the same capabilities can also help attackers quickly develop offensive tools and exploits,” the AI lab added.
OpenAI worked with PHP, Calif and Wiz to check for vulnerabilities and develop the fixes.
The White House said federal agencies were assessing the potential impacts of the bugs on government systems and critical infrastructure.
PHP’s wide presence on the Internet is largely due to the fact that WordPress, the most widely used website building platform, is primarily written in PHP and relies on it to function.
The UK’s National Cyber Security Center said these vulnerabilities could potentially allow a hacker to take control of a website’s server without needing a password or other login credentials. “The NCSC encourages UK organizations to take immediate action,” it says.
Gn headline
