You could be forgiven for reading recent headlines about massive and easily exploitable security vulnerabilities in the internet’s core infrastructure and thinking: Stop the web, I want to log off.
The most recent one ranks as one of the worst in terms of making any individual person online feel powerless: Teams of researchers using artificial intelligence tools from OpenAI and Google found serious and long-standing weaknesses in a scripting language called PHP used at about 70 percent of all websites.
(The Washington Post has a content partnership with OpenAI.)
An attacker could exploit these two vulnerabilities, collectively named PHP2Shell, to suck data out of a site and run their own code on it. That could near-instantly turn a trusted site into a threat — without you having any way to know in advance or defend against it.
The government’s Cybersecurity & Infrastructure Agency’s advisory recognized the seriousness of the problem, directing site owners to “apply the patch immediately, prioritizing internet-facing systems” — or take every PHP-based system offline until they could patch it.
If you’ve seen some sites you use greet you with an under-maintenance sign or not have some functions available, these vulnerabilities probably explain why.
It all reminds me of the year-2000 bug in that it’s a problem that could hurt you, but which you could do nothing on your own to fix — except instead of years of buildup before armies of unsung programmers and IT workers fixed Y2K, all of this got sprung on us.
Don’t panic.
Like Y2K, PHP2Shell isn’t just another bug. Madeline Lawrence, co-founder of the security-testing firm Aikido, offered a couple of bad-day scenarios in an email response: An attacker could steal a company’s customer data and turn a legitimate site function like a checkout into a tool to capture still more personal details.
But the advice of security professionals is not to panic, and to instead keep doing the things you already should have been doing to stay safe.
“The most important thing is to practice good security hygiene all the time, rather than scrambling every time a major vulnerability makes the news,” said Ed Skoudis, president of the SANS Institute, in an email sent by a publicist for that North Bethesda security-training organization.
He offered this advice this advice that you’ve seen here before:
• Don’t reuse passwords, so that an attacker who obtains one of your passwords can’t use that to log into any of your other accounts.
• Set up two-factor authentication to stop an attacker from taking over your account just by getting your password.
• Use a password manager to create and remember complex passwords for you and flag any reused passwords.
• Use passkeys if available to give your accounts the strongest possible protection.
• Install security updates promptly, preferably automatically.
“You can’t personally secure every website you visit, but you can make sure that a security failure at one website doesn’t turn into a disaster across all your accounts,” Skoudis said.
Lawrence offered similar advice, plus a prediction — highlighted in yellow in her message — that attackers will craft “more convincing scams” by abusing personal data purloined via the PHP vulnerabilities.
“Always verify unexpected requests through official channels,” she wrote. “Take breach notices seriously. If a service says you were affected, follow its instructions.”
Note that federal law and financial-industry practice effectively protect you from liability for credit card fraud — which gives sites a powerful motivation to keep your payment details safe. But Congress has spent years failing to enact any sort of comprehensive privacy bill that might set comparable standards for other data about you.
When do things stop being terrible?
AI was already revolutionizing security research before the PHP news. Security-specific models — which attackers can use as readily as defenders — can rapidly experiment with different possible exploits, testing and combining them to reveal vulnerabilities that in some cases have existed for decades.
But will what industry types have taken to calling the “vulnpocalypse” eventually reveal a boundary to the bugs? Or will we never get off the software-vulnerability treadmill?
The consensus so far seems to be that this treadmill hasn’t even finished accelerating.
“Things will get a lot worse before they get better,” Skoudis predicted. “AI is bringing to light the existing vulnerabilities in this world at a new speed, scale and consequence.”
Lawrence shared that assessment.
“AI is giving us powerful new ways to discover vulnerabilities that have been hiding for years,” she wrote. “Because of that, we actually will likely see MORE alarming vulnerability announcements in the near term as AI helps us uncover these long-standing problems.”
You can blame even more of that on AI if you want: AI-assisted vibe coding keeps yielding apps with glaring security holes.
In other words, if somebody in your life works on information security, you shouldn’t expect them to have more free time anytime soon.
“We’ve got to buy some Red Bull, we’ve got to buckle up, we’ve got to clear the backlog,” summed up John Doyle, founder and CEO of Cape, a privacy-optimized wireless service based in Arlington, in a keynote at a security conference in the District on Monday.
Lawrence observed how AI’s ability to accelerate finding bugs can also accelerate fixing them. If you want some hope, that’s where you should be looking.
“What makes me most optimistic is AI’s potential to help us find vulnerabilities, fix them, and prevent similar mistakes from happening again,” she wrote. “But it’s bumpy now and will likely remain so for some time.”
The post Worried about a new wave of AI hacks? Take these steps right now. appeared first on Washington Post.
