PHP vulnerability shows need for open-source maintenance

When OpenAI and a team of researchers discovered a devastating zero-day vulnerability in the open-source scripting language PHP—one that has existed since 2014—it raised questions about who maintains the systems and files that underpin the modern tech stack.

To Vlad Korsunsky, Tenable CTO, the crisis is a good example of the emergency presented by vulnerable open-source infrastructure, which is a basic component of the tech stack—and a dependency for nearly every enterprise, whether they know it or not.

“Open source is awesome, it powers innovation, it’s everywhere, and it allows you to use the community as a force multiplier,” Korsunsky said.

Easy does it. Many open-source products have only a single volunteer or group of people who act as maintainer and monitor. While that’s largely proven stable so far, AI tools have complicated that picture.

Prior to the explosion of AI detection tools, maintaining open source was relatively easy. One person, or one small group of people, could reasonably expect to manage the software.

That’s all over now, as Arcova Advanced Services Lead Joseph Perry told IT Brew last week, especially when it comes to AI allowing attackers to successfully weaponize long-undiscovered vulnerabilities in critical systems.

“If the only thing in the way before was time and complexity, those things are soluble just by turning them into a compute bill,” Perry said. “That’s more or less what happened here.”

The response to the PHP vulnerability from state and private enterprises alike has been heartening for security pros. Advisories from major US agencies like the NSA and FBI, telling users to patch their systems or take them offline, carry weight, though there’s a bit of wiggle room for internal infrastructure.

“If I have a system that’s internet-facing, that’s 100% my first priority, to go and take care of that,” Korsunsky said. “If that system is behind five firewalls in my test environment, nobody really cares about it—sure, I have to patch it, but it’s not a five-alarm fire.”

Tracking down. With AI threat detection, the potential for finding vulnerabilities is much higher—and happening more quickly. It’s helpful that companies like OpenAI are working with researchers, Korsunsky told IT Brew; attackers are not sitting on their hands.

“You can’t protect what you don’t see, so it starts with visibility,” Korsunsky said.

Part of that visibility is utilizing the transparency of open source to your advantage when assessing infrastructure, he added.

“Look at the maintaining account—is there an active recent activity of new commits of new changes to the code? What’s the release cadence? How responsive is the project to security reports? If there is an issue, are there maintainers that are jumping on it and issuing fixes?” Korsunsky asked. “You get the privilege of looking under the hood and seeing how the open source is maintained.”