AI is finding vulnerabilities rapidly. Governments that know what software they’re using and where are more likely to be ready the next time a major vulnerability is found.Now is the time to plan out details, like which sites or systems to patch first and who has the authority to decide when an important website should be taken down for fixing.Officials should also plan how they’ll communicate to the public about what’s going on.Websites went down all over the world last week, including webpages for government agencies and major companies. Users could no longer access sites for Australia’s national cyber defense agency, Netherlands’ national digital identity service or the Paris police, among many others.The service interruption wasn’t a widespread hack, but an emergency precaution. Last week, two critical flaws were announced in a programming language called PHP, which is used in roughly 70 percent of websites. Researchers used AI to help discover one of the bugs in August; AI also helped show how the other bug, which the organization behind PHP has known about since 2024, could be exploited to attack.The flaws posed serious security threats; hackers who manage to leverage them could shut down or alter websites, access private information or cause other problems, says Michael Klein, senior director for preparedness and response at the Institute for Security and Technology.PHP “originally stands for ‘personal home page,’ that’s how old it is,” Klein says. “It’s the plumbing from the Internet’s very beginnings, its first decade. And it’s still running many systems, including city websites.”PHP is part of major sites including WordPress and Wikipedia and is often a component of other software, so organizations might not realize they’re running it.The good news: a patch is available to fix those flaws, at least for more recent versions of the software. (About half of the Internet-connected PHP software is one of the older versions for which there currently is no patch, Klein says. Patches may be in the works for some of these old versions, while others may never get fixed).Federal leaders jumped into action. Japan’s prime minister urged website operators to apply patches as soon as possible, and the FBI advised anyone who couldn’t immediately apply a patch to take their websites offline until they could.Governments and their vendors needed to act rapidly to protect themselves. So far, the efforts are paying off. None of the counties he’s in touch with has reported a breach, National Association of Counties CIO and Managing Director John Matelski told Governing on Monday. On Friday, the federal Cybersecurity and Infrastructure Security Agency similarly said it was unaware of anyone successfully using the vulnerabilities to hack an organization.But the incident is yet another example of how artificial intelligence is creating new cybersecurity risks for the world’s organizations. Good faith researchers and hackers both can use AI to find vulnerabilities, and organizations need to have plans in place for how they’ll respond to the next emergency.AI Changes the LandscapeThe PHP fiasco is a story of both the good and bad effects of AI. Two different cybersecurity companies, Calif and Wiz, each independently discovered one of the vulnerabilities, in both cases with the aid of AI tools. On Oct. 21, the PHP Foundation — the almost-entirely volunteer team that maintains the PHP programming language — released a patch to fix the two newly announced vulnerabilities.Either one of the vulnerabilities could be used by hackers to access IT systems without a login. Financially motivated hackers might shut down a website and attempt to extort money from governments. (Ransomware actors have attacked governments before, including shutting down IT systems for school districts or stealing and threatening to release police files.) Hackers affiliated with other nations might use the weaknesses to gain a foothold in a government or organization’s IT systems, lying in wait to cause havoc at an opportune moment.The PHP Foundation already knew about one of these vulnerabilities. A 2024 audit uncovered it, but at the time “nobody could figure out how to exploit the bug,” Klein says, so the team instead prioritized fixing more urgent problems.Flash forward two years, and researchers have found ways that today’s powerful AI models could assist a hypothetical hacker through a complex set of steps to turn that vulnerability into a serious attack.“AI can take that kind of weakness that was only theoretical at one point and … turn it into a working attack,” Klein says. “That really changes the way that we think about vulnerabilities.”The foundation and cybersecurity researchers worked together to create a patch. They collaborated in advance with major software vendors so the latter would be ready to apply the fix to their software once the patch was officially announced. But a vendor jumped the gun on releasing the information, Klein says. A few days early, word of the patches — and thus the existence of flaws that needed to be patched — leaked. That sparked a flurry of unsuccessful hacking attempts. Entities have been taking down their sites until they can protect their software.Jumping Into Action – Now and the Next TimeGovernments that had their prep work in place could spring into action sooner. For example, governments that had already inventoried all the software they or their vendors were running knew quickly whether they were at risk. Those that had plans in place prioritizing security fixes (say public safety first, finance or something else) didn’t have to work that out on the fly.This won’t be the last time governments have to spring into action over new vulnerabilities, so getting the right process in place now matters, Matelski says. That includes having a careful process for applying patches, then checking the updates worked and didn’t disrupt other processes.Events like the PHP exploits demonstrate a new normal, in which more vulnerabilities are found and exploited faster than we’re used to, Klein says.Governments can prepare against the next such incident in part with tabletop exercises, where they talk through how they’d respond — including who decides whether to take down a site. Reacting quickly matters, but a town likely doesn’t want IT officials shutting down key websites without consulting town leadership, Klein says. Governments will also want to have a plan for communicating what’s going on to constituents, and a plan for determining how long to keep a site offline waiting for a patch before they simply decide to build a new site without the security weaknesses.
window.fbAsyncInit = function() {
FB.init({
appId : ‘314190606794339’,
xfbml : true,
version : ‘v2.9’
});
};
(function(d, s, id){
var js, fjs = d.getElementsByTagName(s)[0];
if (d.getElementById(id)) {return;}
js = d.createElement(s); js.id = id;
js.src = “https://connect.facebook.net/en_US/sdk.js”;
fjs.parentNode.insertBefore(js, fjs);
}(document, ‘script’, ‘facebook-jssdk’));
——————————————————-
Click Here For The Original Source.
