On Wednesday, several French prefecture websites became inaccessible. At the same time, the Dutch parliament, German and Finnish ministries and Scottish health services were also taking some of their sites offline. It was not an attack. It was a race against time to prevent one.
The cause: two vulnerabilities of rare severity, discovered with the help of artificial intelligence.
What happened
PHP is a programming language that runs, behind the scenes, around 70% of the websites whose technology is known. WordPress sites, PrestaShop shops, a large share of government sites: all of them rely on it.
On 21 October, the PHP maintainers urgently released patches for two critical vulnerabilities, nicknamed "php2shell". They affect the way PHP manages computer memory, and could allow an attacker to read sensitive information on a server, or even run their own commands there, without even needing to log in. They had remained hidden in the code for more than ten years.
The alert was taken very seriously. The US National Security Agency, the NSA, issued a rare public warning, advising that sites be taken offline if they could not be updated immediately. The cybersecurity agencies of Europe, the United Kingdom, Australia and Japan gave the same advice. According to the head of Cloudflare, millions of exploitation attempts were observed within a few days.
The role of AI
The first vulnerability was reported in early August by researchers at a security company, Calif, with the help of an OpenAI model, as part of a programme launched by OpenAI to identify flaws in essential infrastructure. The company Wiz found them independently on its own side. For two months, the specialists worked in secret with the PHP team to prepare the patches before making everything public.
Wiz describes them as among the most serious vulnerabilities ever discovered in PHP, and probably in the history of software. The researchers sum up the shift: with the right models and the right tools, a single researcher accomplished in one week what would have taken a top-level team months.
In 2014, a vulnerability named Heartbleed was discovered in OpenSSL, software that secures connections on the internet. It allowed chunks of server memory to be read, and therefore potentially passwords. Around half a million secure sites were affected. It had been found by human researchers, after remaining hidden for two years. Php2shell recalls the same lesson, with one major difference: this time, it was AI that made it possible to find what years of human review had let through.
A double-edged sword
This is the good news in the story: AI made it possible to find and fix these vulnerabilities before they caused havoc. This is exactly the promise of the cyberdefence programmes that labs are launching.
But it is also a cause for concern. What AI makes it possible to find in order to defend, it also makes it possible to find in order to attack. And as soon as a patch is released, attackers analyse it to understand the flaw and exploit it on sites that have not yet been updated. As we explained with the attackers who got ahead thanks to AI, the race between attackers and defenders is speeding up.
Do you have a website? At the end of the day we detail the steps to take right now.
Key takeaways
For decades, the web's deepest flaws lay dormant in code that no one had the time to read through in full. AI has just changed that.
It will make it possible to clean up years of hidden flaws. Provided defenders move faster than attackers, who now have the same tools at their disposal.