Cybersecurity teams around the world are racing this week to patch flaws in the PHP programming language, in an artificial intelligence security moment described as “Black October.”
Nearly 70% of all websites use PHP, according to some estimates.
“Over the past two days, there have been several dozen cyberattacks that, taken in isolation, would each have been the worst to have occurred in an entire calendar year,” wrote John Milinovich, senior director of product management at Figma, in an article on X on Thursday. “Every sector from government to education to big tech to banking is being massively impacted, and people are starting to panic.”
Researchers at Google Wiz and AI company Calif discovered major vulnerabilities in PHP in August using advanced AI models from OpenAI and Google. But on Tuesday, warnings spread online, prompting governments and businesses around the world to scramble to contain the fallout.
Major AI companies have been warning about the technology’s advanced cybersecurity capabilities since April, when Anthropic announced a limited deployment of its powerful model called Mythos. Concerns grew in July, when OpenAI revealed that two of its models had escaped lockdown, accessed the open internet and hacked a company called Hugging Face.
Experts say the PHP security flaws are the latest example of what’s to come.
Jason Clinton, deputy chief information security officer at Anthropic, wrote in an article on X on Thursday that the cybersecurity landscape is likely to get worse before it gets better.
“Security leaders, never let a crisis go to waste: please reach out to your boards and ask for help now,” Clinton said. “Not for AI, for basics. (We have to hold out for about 18 months.)”
While many large companies have access to advanced models they can use to harden their systems, serious bugs could be harder to fix for small and medium-sized businesses, Chris Krebs, former director of the U.S. Cybersecurity and Infrastructure Security Agency, told CNBC on Friday. He encouraged small businesses to “constantly” scan for vulnerabilities, deploy patches as quickly as possible or take existing systems offline.
“It’s an important week or two in cybersecurity,” Krebs told CNBC’s “Squawk Box.” “As I mentioned, 3% of all critical vulnerabilities ever discovered were discovered in the last month.”
Figma’s Milinovich encouraged individuals to set up two-factor authentication for “everything,” use a password manager, set up an identity protection app, and move smart devices to their own network. He added that people should be interested and experiment with AI to understand how powerful the tools have become.
“While I still strongly believe that AI will have a net positive effect for humanity, it is clearer than ever to me that the societal and individual risk is very real and playing out NOW,” Milinovich said.
Krebs added that company leaders and employees should audit their security teams.
“Make sure they’re OK,” he said. “They’ve had a hell of a week.”
—CNBC’s Isabel O’Brien contributed to this report
WATCH: Chris Krebs on AI discovering cyber vulnerabilities: It’s going to get worse before it gets better
Gn headline
