Massive PHP flaw highlights cybersecurity challenges in the AI era

Sponsored by

AI agents are starting to do more than access systems. They can invoke tools, execute workflows, and take action across business applications. As that autonomy grows, IT needs visibility into what each agent is allowed to do, what it actually did, who owns it, and how to revoke access when needed. Learn how JumpCloud helps govern AI agents alongside human and device identities.

How do you fix a vulnerability that could undermine the whole net? Asking for a friend…

On Oct. 21, OpenAI reported that its AI had exposed a critical flaw in PHP, the open-source programming language that supports many websites and web applications. The company is framing the vulnerability as one of the “most impactful security issues in recent memory”; around the world, companies and governments are rushing to patch their websites—or take them offline altogether.

Wiz Research stressed how the exploit allows attackers to execute code on affected servers or read sensitive processing memory. According to survey company W3Techs, PHP is used by an estimated 69.3% of all websites.

Gerald Caponera, SVP of risk and threat exposure management at Dataminr, said that he and his team were made aware of the vulnerability on the afternoon of Oct. 20. According to the company’s blog post, that information leaked ahead of a “coordinated disclosure.”

Caponera said that the vulnerability hit the top of prioritization lists on Wednesday morning. His initial thoughts: “Here we go again…When are we going to learn?” And on top of that: “We can use this to change how security works writ large.”

Don’t panic. Caponera said he was more annoyed than panicked at the news, adding that fear is dangerous for security practitioners during events like this. IT teams need context and information to inform their next steps when protecting systems against specific vulnerabilities.

Caponera suggested organizations approach addressing a vulnerability by asking some crucial questions:

• Can this actually exploit my organization’s systems?
• How can my organization prioritize defending the most mission-critical systems?

“By focusing on those data points, focusing on analytics and data lets you get away from panic,” Carponera said.

Time to lock in. Joseph Perry, advanced services lead for global cybersecurity and AI enterprise consulting firm Arcova, told IT Brew that this incident demonstrates how AI can reveal vulnerabilities that have not been exploited by human attackers before AI’s emergence, and show attackers how to better weaponize those vulnerabilities.

“If the only thing in the way before was time and complexity, those things are soluble just by turning them into a compute bill, and that’s more or less what happened here,” Perry said.

Right now, Perry said that professionals should look to patch instead of implementing a compensating control, or an alternative cybersecurity measure that can involve a firewall or network segmentation when patching isn’t an option.

Once vulnerable systems are patched and updated, Perry strongly recommends IT professionals heavily scrutinize every log that touches PHP and web servers, and build detections.

“We’re running some threat hunts internally and externally, specifically focused on fingerprints related to this activity,” Perry said. “It’s really going to be essential for the organization to lock in on: ‘What are we using PHP for and how are we touching it?’”