internet

Earlier this month, authorities worldwide urged website administrators to execute emergency updates after a nonprofit programming foundation flagged critical security flaws that could allow hackers to breach systems.

Government and corporate websites briefly went offline to patch the vulnerabilities, nicknamed PHP2Shell, which were discovered by independent cybersecurity experts using artificial intelligence (AI).

The vulnerabilities were embedded in the code of a widely used open-source web programming language, PHP, for more than a decade. They had gone unnoticed, however, because it would have been too complicated for humans to exploit them without the use of advanced AI.

But cybersecurity experts, as well as those maintaining important software, say PHP2Shell could be the first in a deluge of security flaws exposed by emerging AI. They say much of the world’s most critical digital infrastructure is maintained by volunteers, who often lack the resources and time to respond to newly discovered threats.

“There’s been a lot of people in the AI safety community that said this is one of the first areas where we are going to see the harmful impact of AI,” said Peter Slattery, a research scientist at MIT’s FutureTech, who studies how cybersecurity experts are dealing with the new technology and tracks real-world incidents involving AI.

A digital world built on volunteer work

PHP got its start in 1995, when Danish-Canadian programmer Rasmus Lerdorf sought to track how many people visited his online resume. Over time, others around the world improved Lerdorf’s software, and it grew in popularity.

As with other open-source coding projects, anyone could download, modify and share improvements. Websites like Facebook and Wikipedia were built using PHP, which runs about 70 percent of the world’s websites.

In 2021, a dedicated nonprofit, the PHP Foundation, was launched to coordinate development. Like many other foundations maintaining open-source software, it operates on a meagre budget.

Most of the digital infrastructure consumers use is powered by open source software. The Mozilla Firefox browser is open source, as are languages like Perl, Python, and JavaScript. The software that lets a computer communicate with others on the internet is often open source, with many servers using products like Apache HTTP Server, maintained by the Apache Software Foundation.

“The world today, including proprietary software vendors, relies on open source software for its digital infrastructure,” said Amanda Brock, CEO of OpenUK, a nonprofit that supports open source software.

The world’s largest corporations, like Meta, Google, OpenAI and Anthropic, depend on that volunteer-built, open-source infrastructure. Now, those companies’ own AI tools are uncovering security flaws in the infrastructure at a pace that needs far more resources for groups like the PHP Foundation to keep up.

“It’s simply not possible with the resources in place to fix all of the known vulnerabilities,” Brock said. “Foundations are attempting to manage these challenges, but the smaller ones don’t have hundreds of millions in funding, and managing this at the pace AI requires is proving impossible.”

A deluge of new bugs to fix

The PHP2Shell vulnerabilities were found through several advanced AI models, which can employ far more complicated attempts to hack past security barriers than humans could.

Developers of other software are also discovering far more security flaws than in the past because AI is being used to probe defences.

Google said it uncovered more than 1,000 security bugs in the last update for its Chrome browser, more than in the last two dozen updates combined. Mozilla, the foundation behind the Firefox browser, found more than 400 security vulnerabilities in April, a significant jump from the previous record of 76 bugs discovered just one month earlier.

“We have maybe 10 times more issues than usual because we are using AI to find them,” said Jarek Potiuk, part of the volunteer security team at the Apache Software Foundation. (In keeping with the foundation’s non-hierarchical ethos, Potiuk said he has no real title).

Potiuk said there is an “industry-wide movement” to conduct scans using AI models and identify security vulnerabilities, much like was done to find the bugs in PHP. But the scans themselves cost money – used to pay for the tokens for AI models – and afterwards, humans must pore over them to weed out false positives.

“Every project, every foundation is doing this right now – spending enormous amounts of time to find these issues,” Potiuk said. “AI helps to find them, but you have to verify things, you have to review them.”

Earlier this year, Anthropic launched Project Glasswing, offering $100m in credits to support its advanced Claude Mythos AI model to search for security vulnerabilities in the world’s critical software. In one month, more than 23,000 vulnerabilities were found across more than 1,000 open source projects.

The Apache Software Foundation has taken advantage of another scheme, the Alpha-Omega project, to scan for security bugs across the 290 software packages it maintains. The project, backed by companies like Anthropic, Amazon, Google, Microsoft and OpenAI, spends about $7m a year helping open-source developers find critical security bugs.

But those working on finding and fixing the security flaws say the corporate world could be doing a lot more, given the trillion-dollar valuation of companies whose products would not work without free software like the packages the Apache Foundation provides.

“They are helping a lot, but we need more active players in this area,” Potiuk said, “because it’s highly disproportional – the impact it has on the corporate world versus the open source world”.

When a major security flaw like PHP2Shell is uncovered, it often comes down to a handful of volunteers to fix it.

Keeping the internet’s infrastructure as decentralised and open-source as possible is crucial, Potiuk said. Instead of buying out something like PHP, major players like Google or Microsoft could, for instance, pay staff to dedicate some of their work hours to maintaining open-source projects they use.

Real-world targets

The 2021 Log4Shell vulnerability, which allowed hackers to remotely run code on millions of devices through a widely used library maintained by the Apache Software Foundation, underscored the critical role open-source software plays in system security. That bug was discovered without the use of AI.

Suddenly, cars, microwaves and a host of electronic devices connected to the internet were vulnerable, Potiuk said.

“That was the moment when the whole ecosystem realised how important it is to take care of open source,” he said.

A bug like that, if found by a malicious hacker and exploited before there is a chance to patch devices, could have caused a major disruption.

Slattery said the database of incidents he and his colleagues maintain shows that an increasing number of vulnerabilities are being detected, and it is a matter of time before some are exploited in the real world.

“We are starting to see both a lot more vulnerabilities detected and addressed in time, but also attacks on a wide range of systems,” Slattery said. “We have been moving in this direction for a long time. There are more and more things now you can attack.”

Government websites in Europe and elsewhere have gone offline after news of critical vulnerabilities in a widely used programming language sent website operators scrambling to protect their systems.

Developers of the PHP programming language on Wednesday released urgent new fixes, saying all users were “encouraged to update immediately”.

PHP runs on the servers that host websites, building pages behind the scenes before they reach a visitor’s browser. Most people never see it, but it powers everything from blogs to online shops and government portals.

The vulnerabilities, which had been lurking in the software for years, were uncovered with the help of artificial intelligence. Details about them leaked online on Tuesday before fixes were available, forcing PHP to rush them out.

Experts said they were bracing for a wave of intrusions as hackers jumped to get ahead of the updates.

What is the bug?

Andrew Cullen, a lecturer on AI and cybersecurity at the University of Melbourne, said many devices in the world are connected to one piece of foundational software, which is where the bug was found.

The vulnerability allows a hacker to run code on a website, meaning they could change the website or force it to release personal information collected in a database, Cullen told Al Jazeera.

Both flaws stem from how PHP handles fatal errors, such as running out of memory. Because the problem sits in PHP itself, even the simplest website running an affected version can be vulnerable, and attackers could read passwords and other credentials from a server’s memory, the cloud security company Wiz said. Both flaws scored 9.2 out of 10 on the industry’s standard severity scale, placing them in the “critical” category.

The two flaws, nicknamed PHP2Shell, were found independently by two cybersecurity companies using AI. Calif, working with OpenAI, reported the first on August 11. Wiz, which is owned by Google, reported the second on August 24.

The vulnerabilities remained hidden in the PHP codebase for more than a decade and would have been extraordinarily complicated for a human hacker to take advantage of, Wiz said in a statement.

Calif and Wiz said they had coordinated with each other, the PHP team and OpenAI before making the vulnerabilities public.

However, Amazon security chief CJ Moses said his security team detected an attempt to exploit the vulnerabilities on October 17, four days before the public disclosure.

Moses said it was unclear how the hacker learned of the flaws while Calif’s and Wiz’s reports were still under embargo. Security researchers usually keep details of flaws secret until a fix is ready, so attackers cannot use them in the meantime.

Who can potentially be affected?

PHP, a language that dates back to the early 1990s and initially stood for Personal Home Page, underpins huge parts of the public-facing web and is baked into WordPress, Drupal, Joomla and Magento sites, meaning any critical vulnerability potentially has enormous knock-on consequences.

Calif, Wiz and the web infrastructure company Cloudflare said the flaws affect PHP 5.4 and later versions, more than a decade of releases.

Cullen said the vulnerability was “really unprecedented”, noting that PHP powers more than 70 percent of websites globally, although sites that have been updated are protected.

“There is a real risk to the kind of shared digital infrastructure that we all rely on,” Cullen told Al Jazeera. “There is concern in the cybersecurity community about what the blast radius for this will be, even though the developers of PHP have been very quick to try and develop patches for it.”

Cullen added that while AI was getting better at cybersecurity, it was also getting better at being a hacker. “This means that we are developing systems … that are making the internet safer by helping to fix bugs, but we’re also making it riskier by discovering bugs and creating bugs they’ll be able to hack,” he said.

What has the impact been so far?

In the Netherlands, the Dutch cybersecurity agency itself went offline, saying it had done so as a precaution because of the vulnerabilities. Several organisations followed the example and took public-facing websites offline, including the Port of Rotterdam, government portal Overheid.nl, the national football association KNVB, the websites for the country’s five largest political parties and several hospital ‌websites.

Dutch Prime Minister Rob Jetten said he was closely monitoring the situation.

Disruptions were even more widespread in Finland, where state IT services provider Valtori said government public network services had been taken offline “as a precautionary measure”.

France’s Ministry of the Interior said it had placed all of its websites into preventive maintenance.

Belgium’s Federal Public Service Foreign Affairs, Foreign Trade and Development Cooperation said it had temporarily taken its websites offline after reports of cyberattacks exploiting the PHP vulnerabilities although the country’s cybersecurity centre said it had not recorded any attacks on Belgian websites.

South Korea’s ⁠government raised ⁠its private-sector cybersecurity alert level and activated emergency response measures. It issued security guidance to about 28,000 companies with registered chief information security officers and 5,900 members ⁠of a government information-sharing ⁠network as well as operators of critical infrastructure, web-hosting firms and data centres.

The operator of the online encyclopedia Wikipedia also said it had taken down an unspecified number of systems until they could be safely patched while the Internet Archive, the sprawling online library, said it also briefly went offline to deal with the issue.

Mexico will require the digital platforms to protect minors from violent and sexual content.

Mexican ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠President Claudia ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Sheinbaum signed a presidential decree requiring digital platforms, including TikTok, Meta and X, to protect children from violent, sexual and other harmful content online.

The decree establishes that digital platforms must, by design, restrict exposure to content involving violence, harassment or sexual abuse, as well as immediately remove any risky material from the profiles of minors.

Sheinbaum said on Wednesday that the government would back legislation to penalise companies that fail to implement the decree.

“If no progress is made, it would become a law,” she told a news conference on Tuesday.

“The goal is for digital platforms to take on some of the responsibility and refrain from disseminating, promoting, or spreading content related to this type of information — including criminal acts or violent behaviour,” Sheinbaum had said earlier when she indicated she would introduce the decree.

The decree comes after an attack by two 18-year-olds on their former high school in the northern ‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌state of Coahuila in early October that killed one and wounded three others.

Digital platforms will have one month to comply with the decree, government adviser Luisa Maria Alcalde said.

Officials said they had already discussed the matter with representatives of social media outlets and streaming platforms such as Meta, Microsoft, Apple, TikTok, Google, X and Huawei.

Last August, Meta, for example, agreed to pay an $18bn settlement in a major US federal case accusing it of endangering children, and was forced to introduce new safety features to platforms including Instagram and Facebook. The lawsuit alleged Meta had violated the Children’s Online Privacy Protection Act by collecting, ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠retaining, and using personal data from children under 13 without proper parental consent.

Mexico’s move follows a broader global push to protect minors online, with governments in Europe and Australia tightening oversight of digital platforms and US states pursuing a range of child-safety measures.

Brazil has also moved to strengthen protections for children online. Such measures have raised questions over how to protect minors while safeguarding privacy and freedom of expression.

Elon Musk’s latest comments come days before Mukesh Ambani’s low-cost Reliance Jio’s parent launches India’s largest-ever initial public offering.

‌Billionaire entrepreneur Elon Musk has said he would price his Starlink satellite internet service affordably ⁠in India to take ⁠on Mukesh Ambani’s low-cost Reliance Jio, escalating his attacks on the rival tycoon days before Jio’s parent launches the country’s largest-ever initial public offering (IPO).

Jio Platforms, ⁠which owns the telecom arm, is targeting a valuation of $106bn in the offering. Much like SpaceX-owned Starlink, Jio’s satellite venture is also awaiting final ⁠security clearance to launch.

Cheap data is the playbook that built Jio in India, and the one Musk has used in markets like Kenya to unsettle local telecom players. SpaceX now plans to enter the mobile carrier market itself, starting in ‌the United States.

Musk did not specify prices for India, where mobile data costs about rupees 7.74 ($0.08) per gigabyte, among the lowest in the world.

“Obviously, if Starlink is too expensive in India, no one will buy it, so SpaceX will need to make pricing affordable,” he said in a post on his social media platform X on Saturday.

“The reality is that ⁠competition would greatly benefit the average citizen in India by ⁠giving them more choices, as it always does. Ambani’s profits will be lower, but he is not going out of business,” Musk added.

‘Prime Minister Ambani’

Musk’s remarks were the latest in ⁠a series of X posts in which he accused Prime Minister Narendra Modi’s government and Ambani of stalling Starlink’s entry ⁠into one of the world’s biggest internet markets to ⁠favour market leader Jio.

The posts have marked a sharp turn for Musk, who has long enjoyed a warm public rapport with Modi.

India’s government has denied any bias in its approval process, ‌noting that the three satellite ventures seeking to launch, including Starlink’s and Jio’s, are all awaiting final security clearance.

Late on Friday, Musk taunted Ambani directly, addressing ‌him as “Prime ‌Minister Ambani” and asking whether he would “consider allowing Starlink to compete”.

Reliance has not responded to Musk’s remarks.