Abstract:
Researchers used models from OpenAI and Google to discover serious vulnerabilities in software used by the vast majority of websites around the world. Amazon warned that researchers using artificial intelligence tools have discovered security flaws in a programming language that powers a large number of websites on the Internet, and that these vulnerabilities are currently being exploited on a large scale. Governments and companies around the world are scrambling to take measures to ensure the security of their systems.
The world's largest cloud computing services provider said on Wednesday it discovered that hackers had attempted to exploit the vulnerabilities as early as four days before they were disclosed to the public.
Amazon added that the vulnerabilities are "currently being widely exploited in real-world network environments."
Earlier in the day, the US National Security Agency (NSA) and British authorities warned that these vulnerabilities put websites around the world at extremely high risk of hacker attacks. According to reports, some European governments have temporarily taken some websites offline while they repair these two security vulnerabilities.
The vulnerabilities went undetected for more than a decade until researchers identified them with the help of artificial intelligence models from OpenAI and Google. The breadth of the vulnerability's potential impact highlights the ability of artificial intelligence to disrupt the cybersecurity landscape.
Earlier this year, Anthropic and OpenAI launched new models with powerful cybersecurity capabilities, triggering warnings from politicians and financial regulators and prompting the U.S. government to temporarily restrict the rollout of these models.
The U.S. National Security Agency on Wednesday warned all agencies that use a programming language called PHP to update their systems immediately or take them offline.
The developers responsible for maintaining PHP had released a software update earlier in the day to fix the vulnerabilities.
The U.S. National Security Agency said: "These vulnerabilities often allow attackers to directly access the server's file system or database. If the update cannot be completed immediately, it is recommended that relevant agencies temporarily take the system offline until the vulnerability is completely fixed."
Researchers from two US cybersecurity agencies, Calif and Wiz, discovered the vulnerabilities. Wiz, a unit of Google parent company Alphabet, estimates that the vulnerable PHP programming language supports about 70% of the world's websites.
OpenAI said on Wednesday: "Given the severity of these vulnerabilities and the widespread use of PHP, we believe this is one of the most significant cybersecurity issues in recent years. To our knowledge, cutting-edge artificial intelligence models discovered these vulnerabilities before attackers."
OpenAI added: "This highlights the ability of artificial intelligence to discover security vulnerabilities that can affect the entire Internet, but the same ability may also help attackers quickly develop attack tools and exploits."
OpenAI worked with PHP, Calif, and Wiz to verify these vulnerabilities and develop corresponding fixes.
The White House said federal agencies are assessing the impact the vulnerabilities may have on government systems and critical infrastructure.
The reason why PHP is widely used on the Internet is mainly because WordPress, the world's most widely used website construction platform, is mainly written in PHP and relies on this language to run.
The UK's National Cyber Security Center (NCSC) said the vulnerabilities could allow hackers to take control of website servers without the need for passwords or other login credentials.
The agency said: "The National Cyber Security Center is urging UK agencies to take immediate action."
Comments