Earlier this month, authorities worldwide urged website administrators to execute emergency updates after a nonprofit programming foundation flagged critical security flaws that could allow hackers to breach systems.
uncertain
hackers → urge → systems
Government and corporate websites briefly went offline to patch the vulnerabilities, nicknamed PHP2Shell, which were discovered by independent cybersecurity experts using artificial intelligence (AI).
asserted
which → go → intelligence
Recommended Stories
list of 3 items- list 1 of 3What’s the PHP coding flaw that could pull down 70 percent of the internet?
- list 2 of 3World leaders warn of security flaws found in PHP programming language
- list 3 of 3OpenAI says its agents turned off own safeguards
The vulnerabilities were embedded in the code of a widely used open-source web programming language, PHP, for more than a decade.
uncertain
vulnerabilities → ’ → decade
They had gone unnoticed, however, because it would have been too complicated for humans to exploit them without the use of advanced AI.
asserted
humans → go → AI
But cybersecurity experts, as well as those maintaining important software, say PHP2Shell could be the first in a deluge of security flaws exposed by emerging AI.
uncertain
PHP2Shell → maintain → AI
They say much of the world’s most critical digital infrastructure is maintained by volunteers, who often lack the resources and time to respond to newly discovered threats.
asserted
who → say → threats
“There’s been a lot of people in the AI safety community that said this is one of the first areas where we are going to see the harmful impact of AI,” said Peter Slattery, a research scientist at MIT’s FutureTech, who studies how cybersecurity experts are dealing with the new technology and tracks real-world incidents involving AI.
asserted
experts → say → AI
A digital world built on volunteer work
PHP got its start in 1995, when Danish-Canadian programmer Rasmus Lerdorf sought to track how many people visited his online resume.
asserted
people → build → resume
Over time, others around the world improved Lerdorf’s software, and it grew in popularity.
asserted
it → improve → popularity
As with other open-source coding projects, anyone could download, modify and share improvements.
uncertain
anyone → download → improvements
Websites like Facebook and Wikipedia were built using PHP, which runs about 70 percent of the world’s websites.
asserted
which → build → websites
In 2021, a dedicated nonprofit, the PHP Foundation, was launched to coordinate development.
asserted
nonprofit → launch → development
Like many other foundations maintaining open-source software, it operates on a meagre budget.
asserted
it → maintain → budget
Most of the digital infrastructure consumers use is powered by open source software.
asserted
consumers → use → software
The software that lets a computer communicate with others on the internet is often open source, with many servers using products like Apache HTTP Server, maintained by the Apache Software Foundation.
asserted
servers → let → Foundation
“The world today, including proprietary software vendors, relies on open source software for its digital infrastructure,” said Amanda Brock, CEO of OpenUK, a nonprofit that supports open source software.
asserted
that → include → software
The world’s largest corporations, like Meta, Google, OpenAI and Anthropic, depend on that volunteer-built, open-source infrastructure.
asserted
corporations → depend → infrastructure
Now, those companies’ own AI tools are uncovering security flaws in the infrastructure at a pace that needs far more resources for groups like the PHP Foundation to keep up.
asserted
groups → uncover → Foundation
“It’s simply not possible with the resources in place to fix all of the known vulnerabilities,” Brock said.
asserted
Brock → ’ → vulnerabilities
“Foundations are attempting to manage these challenges, but the smaller ones don’t have hundreds of millions in funding, and managing this at the pace AI requires is proving impossible.”
asserted
AI → attempt → pace
A deluge of new bugs to fix
The PHP2Shell vulnerabilities were found through several advanced AI models, which can employ far more complicated attempts to hack past security barriers than humans could.
uncertain
humans → fix → barriers
Developers of other software are also discovering far more security flaws than in the past because AI is being used to probe defences.
asserted
AI → discover → defences
Google said it uncovered more than 1,000 security bugs in the last update for its Chrome browser, more than in the last two dozen updates combined.
asserted
it → say → updates
Mozilla, the foundation behind the Firefox browser, found more than 400 security vulnerabilities in April, a significant jump from the previous record of 76 bugs discovered just one month earlier.
asserted
Mozilla → find → bugs
“We have maybe 10 times more issues than usual because we are using AI to find them,” said Jarek Potiuk, part of the volunteer security team at the Apache Software Foundation.
asserted
Potiuk → have → Foundation
(In keeping with the foundation’s non-hierarchical ethos, Potiuk said he has no real title).
asserted
he → keep → title
Potiuk said there is an “industry-wide movement” to conduct scans using AI models and identify security vulnerabilities, much like was done to find the bugs in PHP.
asserted
Potiuk → say → PHP
But the scans themselves cost money – used to pay for the tokens for AI models – and afterwards, humans must pore over them to weed out false positives.
asserted
humans → cost → positives
“Every project, every foundation is doing this right now – spending enormous amounts of time to find these issues,” Potiuk said.
asserted
Potiuk → do → issues
“AI helps to find them, but you have to verify things, you have to review them.”
asserted
you → help → them
Earlier this year, Anthropic launched Project Glasswing, offering $100m in credits to support its advanced Claude Mythos AI model to search for security vulnerabilities in the world’s critical software.
asserted
Anthropic → launch → software
In one month, more than 23,000 vulnerabilities were found across more than 1,000 open source projects.
asserted
vulnerabilities → find → projects
The Apache Software Foundation has taken advantage of another scheme, the Alpha-Omega project, to scan for security bugs across the 290 software packages it maintains.
asserted
it → take → packages
The project, backed by companies like Anthropic, Amazon, Google, Microsoft and OpenAI, spends about $7m a year helping open-source developers find critical security bugs.
asserted
developers → back → bugs
But those working on finding and fixing the security flaws say the corporate world could be doing a lot more, given the trillion-dollar valuation of companies whose products would not work without free software like the packages the Apache Foundation provides.
uncertain
Foundation → work → packages
“They are helping a lot, but we need more active players in this area,” Potiuk said, “because it’s highly disproportional – the impact it has on the corporate world versus the open source world”.
asserted
it → help → world
When a major security flaw like PHP2Shell is uncovered, it often comes down to a handful of volunteers to fix it.
asserted
it → uncover → it
Keeping the internet’s infrastructure as decentralised and open-source as possible is crucial, Potiuk said.
asserted
Potiuk → keep → ?
Instead of buying out something like PHP, major players like Google or Microsoft could, for instance, pay staff to dedicate some of their work hours to maintaining open-source projects they use.
uncertain
they → buy → projects
The 2021 Log4Shell vulnerability, which allowed hackers to remotely run code on millions of devices through a widely used library maintained by the Apache Software Foundation, underscored the critical role open-source software plays in system security.
asserted
software → allow → security
…and 7 more, not listed.
The Aporia
