Cybersecurity leaders warned this week that AI tools will uncover further fundamental weaknesses in global internet infrastructure over the coming months. Researchers used AI to identify critical flaws in PHP, a programming language used by millions of websites. The discovery, announced on 21 October, has been called "Black October". The flaws may have exposed millions of websites to hackers for years. Some experts estimated that 70% of all internet sites were at risk of hacking.
Sam Altman said on Thursday evening that Altman no longer believed every bug could be patched. Jason Clinton, Anthropic's deputy chief information security officer, predicted a "vulnerability tsunami" over the next few months. Clinton said on Thursday evening that insufficient time would remain to patch critical infrastructure. Salesforce CEO Marc Benioff agreed with Clinton and described the situation as a "code red".
Cloudflare CEO Matthew Prince said AI can identify security weaknesses at a speed that will feel catastrophic because security specialists cannot respond quickly enough. Prince predicted an exceptionally difficult next two years as new tools search the internet for vulnerabilities with unlimited patience. Cybersecurity experts had warned for months that AI would make security bugs easier to discover. However, researchers had not used AI to find a weakness as fundamental and critical as the PHP flaws until "Black October". Technology leaders also worry that malicious actors will use AI to exploit vulnerabilities at an unprecedented speed.
Attempts to exploit the PHP flaws have already started. Government and private websites across the US and UK temporarily went offline to patch the bugs after the announcement. The US National Security Agency (NSA) issued an alert urging every website running PHP to install patches immediately. The NSA warned that malicious cyberactors might further exploit the flaws to gain unauthorized server access. The NSA said such access could enable attackers to steal sensitive information, interrupt services or penetrate further into a network.
Prince said Cloudflare, a security provider, had detected evidence of thousands of people attempting to exploit the PHP flaws during the 10 hours before the announcement. Prince said the number rose to tens of thousands during the first 45 minutes after the announcement. Prince said the number reached hundreds of thousands within two hours. Prince said the number had since reached millions.
Researchers at AI security platform Wiz described the discovery as one of PHP's most severe vulnerabilities and arguably one of the worst in software history. The Wiz researchers said the underlying weaknesses had existed for decades. The Wiz researchers said proving that attackers could exploit the flaws required an unusually complicated sequence approaching the practical limits of human research.
AI-Driven Hacking Unveils Critical PHP Flaws, Dubbed 'Black October'
FLASH AIShare
Summary
CFT agencies have flagged a growing threat as AI tools have uncovered critical PHP flaws nicknamed "Black October." Disclosed on October 21, the vulnerabilities could have left millions of websites exposed for years. Security experts warn of a coming "vulnerability tsunami," with AI identifying weaknesses faster than teams can act. The NSA has called for immediate action, as attacks surged hours after the disclosure. Macroeconomic forces and macro-driven volatility are now adding pressure to global cybersecurity.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.