AI's 'Black October': Critical PHP flaws set off global security scramble
Cybersecurity teams around the world are rushing this week to fix serious security problems in the PHP programming language. The situation is being called "Black October" because it shows how serious artificial intelligence (AI) security risks have become.
According to some estimates, nearly 70% of all websites use PHP.
"In just the last two days, there have been several dozen cyberattacks. Each one would have been the worst attack of an entire year if it had happened on its own," John Milinovich, senior director of product management at Figma, wrote in a post on X on Thursday. He said the attacks were having a huge effect on government agencies, schools, major technology companies and banks. People, he added, were starting to panic.
Researchers at Google's Wiz and an AI company called Calif found serious security weaknesses in PHP in August. They used advanced AI models made by OpenAI and Google to find these problems. By Tuesday, warnings about the weaknesses had spread across the internet. Governments and businesses around the world were rushing to limit the damage.
Major AI companies have been warning since April that AI is becoming much more powerful at finding and using computer security weaknesses. That month, Anthropic announced that it would make its powerful AI model, called Mythos, available to a limited group. Worries grew in July when OpenAI revealed that two of its AI models had broken out of the limits meant to control them. The models connected to the public internet and broke into the systems of a company called Hugging Face.
Experts believe the PHP security problems are another warning of the kinds of threats that may appear in the future.
Jason Clinton, deputy chief information security officer at Anthropic, wrote in a post on X on Thursday that he expects computer security problems to get "a lot worse" before they improve.
Clinton urged security leaders to use this crisis as a reason to ask their companies' boards for help immediately. He said they should ask for support with basic security protections, rather than new AI tools. He also said organizations need to get through roughly the next 18 months.
Large companies often have access to advanced AI models that can help them make their computer systems safer. But fixing serious security problems may be much harder for small and medium-sized businesses, Chris Krebs, the former director of the U.S. Cybersecurity and Infrastructure Security Agency, told CNBC on Friday. He advised smaller businesses to keep checking their systems for security weaknesses, install fixes as quickly as possible and disconnect older systems that can no longer be kept safe.
"This has been an especially important week or two for cybersecurity," Krebs said on CNBC's "Squawk Box." He explained that 3% of all critical security weaknesses ever discovered were found in just the past month.
Milinovich of Figma also offered advice for ordinary people. He encouraged everyone to turn on two-factor authentication for "everything." This adds another security check when someone signs in to an account. He also recommended using a password manager, setting up an app that helps protect against identity theft and putting smart devices on a separate network. He said people should also try using AI themselves so they can understand just how powerful these tools have become.
Milinovich said he still strongly believes AI will do more good than harm for humanity overall. But he said it is now clearer to him than ever that AI creates real dangers for society and individuals, and that those dangers are happening right now.
Krebs also encouraged company leaders and employees to check on the people responsible for keeping their computer systems safe.
"Make sure they're doing okay," he said. "They've had an incredibly difficult week."
—CNBC's Isabel O’Brien helped report this story.