Research firm Calif disclosed a critical vulnerability in the PHP programming language on Wednesday that could let attackers control or disrupt systems using PHP. The programming language is used by as much as 70 percent of websites. Security researchers discovered the flaw with help from artificial intelligence tools.
The National Security Agency's Cybersecurity Collaboration Center advised websites unable to fix the issue immediately on Wednesday morning to go offline temporarily. The advice came amid concern that hackers could use AI to exploit security weaknesses quickly. The vulnerability, called php2shell, affects technology that manages website memory while processing computer queries. The disclosure on Wednesday morning followed an opportunity for the nonprofit foundation maintaining the tool to address the vulnerability.
Calif identified php2shell through an OpenAI initiative that helps security researchers discover internet vulnerabilities using advanced AI tools. The vulnerability takes part of its name from PHP. Calif said in a blog post that the firm had not expected to discover critical flaws in PHP because previous researchers had conducted extensive AI-assisted audits. Calif said researchers assembled a version of the vulnerability after several days of investigation. Calif began reporting the bug for repair in August.
OpenAI described the flaws as among the most consequential security issues in recent memory because of their severity and PHP's extensive use. OpenAI said AI can discover vulnerabilities with consequences across the internet. However, OpenAI warned that the same capabilities can help attackers quickly build offensive tools and exploits. OpenAI also suggested that the company had discovered several other significant vulnerabilities undergoing repair.
Cloudflare, an internet security provider, said the company had deployed protections against the vulnerability so websites could continue operating. WordPress also called on website owners to update applications immediately.
Cybersecurity specialists have spent the past six months racing to discover and repair software bugs with advanced AI models before hackers exploit those bugs. AI companies, including OpenAI, tightly restrict access to the most capable cybersecurity models to vetted cybersecurity and technology companies. However, nearly comparable new models from China have become available for anyone to download freely in the past month.
AI has already played a role in multiple high-impact hacks. Earlier this month, a hacker based in China stole detailed customer information from a bank in South Korea. Cybersecurity analysts said the hacker appeared to be an amateur who carried out the attack using AI tools.
Critical PHP Vulnerability php2shell Discovered Using AI Tools
FLASH AIShare
Summary
A critical PHP vulnerability called php2shell has been revealed using AI tools, according to Calif. The flaw could let attackers take control of PHP-powered systems, which run roughly 70% of websites. The NSA's Cybersecurity Collaboration Center warned unpatched sites to shut down temporarily. OpenAI, under a CFT initiative, helped identify the flaw, which it called one of the most severe in recent years. Cloudflare is now blocking attacks, and WordPress urged immediate updates. Risk-on assets may face new cybersecurity pressures.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.