Recommended
An artificial intelligence-assisted discovery of vulnerabilities in a widely used programming language led governments and other organizations in Europe and the United States to temporarily take their websites offline Wednesday as they scrambled to perform security updates.
The FBI's cyber division indicated that the vulnerabilities could allow malicious actors to execute code remotely in the PHP programming language, which could put sensitive data and networks at risk, said the agency, which recommended that website operators take their sites offline if they cannot update them immediately.
The Finnish government's website, for example, was only partially available on Wednesday. A message informed visitors that government websites were experiencing a temporary disruption and that they were fully or partially shut down while the problem was resolved.
"The potential impact is huge," said Ismael Valenzuela, vice president of labs, threat research and intelligence at the cybersecurity firm Arctic Wolf, adding that PHP is used on approximately 70% of websites where the server-side programming language is known.
The exposed vulnerabilities, Valenzuela added, put a "significant portion of the internet's business and commercial infrastructure at potential risk," and while that does not mean every website is vulnerable, the flaws demand "immediate attention."
The PHP Foundation, which includes programming language developers, reported on Wednesday that it had released fixes for the vulnerabilities, along with instructions on how to update the systems.
Artificial intelligence agents helped discover the vulnerabilities. In a blog post, OpenAI stated that it had spearheaded a coalition of researchers, security vendors, and others to address vulnerabilities in PHP over the past two months.
"PHP maintainers led the fixes and publication, and our teams and partners like Wiz, Cloudflare, and others provided research, technical support, and coordination to prepare protections before disclosure," the company stated.
San Francisco-based OpenAI called the flaws "one of the most impactful security issues in recent times." The company noted that artificial intelligence appeared to have found the vulnerabilities before any attacker.
"As significant as they are, these bugs are part of several major vulnerabilities we have already found and are working to fix, and we anticipate that in the coming months, similar findings will increase drastically," OpenAI said.
In recent months, artificial intelligence agents have been blamed for a series of high-profile security incidents. The episodes have highlighted vulnerabilities in AI security and raised questions about how the rapidly growing technology can be developed safely as its use becomes more widespread globally. But experts also noted that AI can help discover cyber vulnerabilities, as it did in the PHP case.
"There is an important paradox. We want AI to act fast enough to find vulnerabilities that humans might miss, while ensuring that increasingly autonomous systems operate within boundaries we understand and control," said Raghu Nandakumara, vice president of industry strategy at the cybersecurity firm Illumio.
"The faster AI becomes at finding weaknesses, the more important it becomes to think about what happens after those weaknesses are exposed, especially when organizations cannot immediately patch every affected system," he added. "The lesson is not that AI is inherently dangerous or inherently protective. It is that speed without control creates a new type of security problem."
Valenzuela, from Arctic Wolf, said that AI advances are also changing which flaws are considered "exploitable," noting that some of these vulnerabilities have existed for over a decade.
"What changed was not the underlying code, but the ability to find those weaknesses and turn them into codes, programs, or instructions that can exploit vulnerabilities," he asserted.
[Publicidad]