AI Found a Critical PHP Flaw.
How Quickly Could Hackers Exploit It?
As Cyber Security Awareness Month puts online threats back in the spotlight, critical vulnerabilities in PHP raise a bigger issue for businesses: AI could be changing the speed at which security weaknesses are both discovered and exploited.
Artificial intelligence is becoming an increasingly powerful tool in the fight against cyber crime.Security researchers can use AI to analyse software, investigate weaknesses and find vulnerabilities more efficiently. That’s good news for businesses. The sooner a serious vulnerability is discovered, the sooner developers and security teams have an opportunity to fix it.But there’s another side to this. The same advances in AI that give security researchers new capabilities are also becoming available to cyber criminals. As AI becomes better at understanding code and technical information, we also have to consider how those capabilities could change the speed at which attackers react to newly discovered weaknesses.A critical security issue affecting PHP provides a timely example.
What’s happened with PHP?
The National Cyber Security Centre (NCSC) has issued an alert over critical security vulnerabilities affecting PHP, a technology widely used behind websites, web applications and other online services.For most business owners, PHP isn’t something they will ever see or need to understand. It could simply sit somewhere behind a website, customer portal, application or another service their organisation depends upon. That’s precisely why vulnerabilities like this matter.The guidance from the NCSC is for organisations to establish where PHP is being used across their infrastructure, prioritise internet-facing systems and update affected installations. It also highlights the importance of monitoring third-party suppliers because PHP may be incorporated into other products and services.But while PHP is the technology at the centre of this particular security warning, there’s a much bigger issue for businesses to consider.
This isn’t really about PHP. It’s about speed
There has always been a race in cyber security. A vulnerability is discovered, researchers investigate it, developers produce a fix and organisations begin applying the necessary updates. At the same time, criminals may be looking for businesses that haven’t acted.AI has the potential to make that whole cycle faster. Used defensively, that’s hugely valuable. AI gives security researchers another powerful way to analyse software and potentially identify weaknesses that previously would have been extremely difficult or time-consuming to find.But attackers aren’t standing still either. The more capable AI becomes at working with code and technical information, the greater its potential to help criminals investigate newly disclosed vulnerabilities and accelerate elements of their attacks.
The gap between a vulnerability being discovered and somebody attempting to exploit it could become smaller.
At Hubtel IT, that’s what we think businesses should be paying attention to.
“The interesting thing about this vulnerability isn’t PHP itself. It’s what it tells us about the changing speed of cyber security. If AI can help researchers find vulnerabilities faster, businesses also have to consider how those same capabilities could be used by cyber criminals. That makes the time between disclosure and patching increasingly important.”
The race between discovery and patching
Patching has always been an important part of cyber security, but in a world where threats can potentially be analysed faster, the speed and consistency of that process become even more important.That doesn’t mean installing every update the second it becomes available without understanding the impact. Businesses still need sensible IT management, testing and change controls.It does mean knowing what’s running across your technology environment, what’s exposed to the internet and who is monitoring newly discovered vulnerabilities that could affect you. This is where what looks like a technical IT issue quickly becomes a question of business resilience.A business owner shouldn’t be expected to know which version of PHP might be running somewhere within their organisation. But they should expect somebody to know.
AI is changing both sides of cyber security
A lot of the conversation around AI in business understandably focuses on opportunity. At Hubtel IT, many of our conversations with businesses are about how AI can improve productivity, help people work more effectively with information and automate processes.Cyber security demonstrates another side of the AI conversation. AI can become an extremely powerful defensive tool. It can help researchers and security teams work through huge quantities of information and potentially identify things that people working alone could easily miss.However, we shouldn’t assume those capabilities will only be used by defenders. Cyber criminals have always adapted to new technology. There’s little reason to believe AI will be any different.That doesn’t make AI something businesses should fear. Used properly, AI has considerable potential to improve cyber security. What it does mean is that businesses need to appreciate how the environment around them is changing.
A timely reminder during Cyber Security Awareness Month
October is Cyber Security Awareness Month, making this latest vulnerability particularly timely. Awareness is important, but genuine cyber resilience is about what happens after a risk has been identified.It’s about understanding the technology your business relies on, knowing where your potential vulnerabilities are and having clear responsibility for responding when a serious issue emerges.As a member of the West Midlands Cyber Resilience Centre, Hubtel IT is part of the wider regional conversation around improving cyber resilience and helping organisations better understand the threats they face.For us, resilience is the important word. Good cyber security isn’t based on the assumption that you’ll prevent every vulnerability from ever affecting your organisation. No business can reasonably guarantee that. It’s about being prepared to respond.The current PHP issue is a good example. Most business owners aren’t going to recognise the name of a particular vulnerability, nor should they need to. What matters is having confidence that somebody is monitoring these issues, understands whether the business could be affected and can take action when required.
The PHP flaw will be patched. There will be another one.
That’s ultimately the bigger lesson. We shouldn’t be frightened by AI’s growing role in cyber security. If AI helps researchers identify serious weaknesses earlier, it can provide an enormous advantage to defenders.But businesses also need to recognise that the cyber threat landscape is changing alongside the technology. Strong cyber security isn’t only about trying to prevent an attack. It’s about understanding the technology your business depends on, keeping systems supported and patched, monitoring emerging threats and knowing how you’re going to respond when something serious happens.For business owners, there’s a simple question worth asking: if a critical vulnerability was discovered in technology your business relies on tomorrow, how quickly would you know about it and how quickly could you respond?You don’t need to understand PHP. You don’t need to become a cyber security expert. But you do need confidence that when the next vulnerability is discovered, your business is ready to respond.
Because in the age of AI, the gap between discovery and potential exploitation could become increasingly important.
How confident are you in your cyber security?
You don’t have to wait for a security incident to discover where the weaknesses in your business might be.If you have concerns about cyber security, patching, vulnerabilities or simply aren’t sure how well protected your business is, talk to the Hubtel IT team.
We can help you understand where the risks are, look at your current approach and have a practical conversation about what you may need to improve.
