TOKYO: Artificial intelligence (AI) has found critical security flaws in PHP, a major programming language, and many websites were taken offline on Thursday as organizations worldwide rushed to protect themselves from hackers. As AI’s fast-advancing capabilities fuel concern over cyberattacks, here are some questions and answers about the situation:What is PHP and how widely is it used? Created in the early 1990s, PHP is a programming language that helps run an estimated 70 percent of the world’s websites. It is “a backbone of the web”, according to security firm Wiz Research, which says it used AI to find vulnerabilities that had been hidden in PHP for more than a decade.PHP, which originally stood for Personal Home Page, underpins popular web design platforms, meaning the flaws could allow hackers to break into a wide range of sites, from online stores to government services.A fix was released on Wednesday. The PHP Foundation told tech departments around the world: “If you run PHP, it is imperative that you update now.” That has taken a range of apps and websites offline, from the Paris police website to a Pokemon sleep tracker, as developers work to protect their code.How did AI find the flaws? Wiz and other groups used cutting-edge AI models, including those from US giants OpenAI and Google, to uncover PHP’s weak spots in August. The findings were kept secret while a fix was developed. Separately, security firm Calif found the flaws during an OpenAI-funded audit of PHP’s code.OpenAI called the flaws “one of the most impactful vulnerabilities in recent memory”, adding that it “marks a new phase, where AI can find security bugs with internet-scale impact”.“The trouble with tools like AI is that the moment all the information’s out there, people can weaponise it very, very quickly,” said Steve Kerrison, senior lecturer in cybersecurity at James Cook University’s Singapore campus. “That’s why everybody’s acting with such urgency to respond to this issue.”Have sites already been hacked? “Taking websites offline does not necessarily mean they have been hacked. It can be a responsible measure to protect systems while security updates are applied,” said Dimitrios Salampasis of Australia’s Swinburne University of Technology.So far, Kerrison said, “the evidence that security researchers are seeing is that nobody was actively performing attacks using the techniques available”. Larger institutions should be able to fix their websites relatively quickly, but others may be left exposed. “There are sites, systems and people out there who will have no idea about this and still won’t for days, weeks and months,” Kerrison warned. These could include user-run blogs that might be used to spread viruses, spam or malicious content.Could there be other consequences? Stolen personal data could later be used in so-called “phishing” attacks, in which people are tricked into revealing their passwords. Because online systems are complex and often rely on third-party services, some vulnerabilities could remain even after a site is fixed. If those third parties use PHP, “then even though you patched yourself… you’re still unsecure”, said Rahat Masood, senior lecturer in cybersecurity at the University of New South Wales in Sydney. — AFP
Click Here For The Original Source.
——————————————————–
