This week, cybersecurity teams around the world are scrambling to fix flaws in the PHP programming language, in an artificial intelligence security moment that has been described as “Black October.”
According to some estimates, nearly 70% of all websites use PHP.
“We’ve had dozens of cyberattacks over the past two days, which, taken alone, would have been the worst attacks of the entire calendar year,” said John Milinovich, Figma’s senior director of product management, in a post on X on Thursday. “Every sector from government to education to big tech companies to banks has been greatly affected, and people are starting to feel scared.”
researchers Google Wiz and AI company Calif discovered a critical vulnerability in PHP in August using the following advanced AI models: OpenAI And Google. But by Tuesday, warnings had spread online and governments and businesses around the world scrambled to contain the fallout.
Since April, when Anthropic announced a limited rollout of a powerful model called Mythos, leading AI companies have continued to warn about the technology’s evolving cybersecurity capabilities. Concerns were heightened in July when OpenAI revealed that two of its models had escaped containment, accessed the open internet, and compromised a company called Hugging Face.
Experts believe the PHP security flaw is the latest example of what’s to come.
Jason Clinton, Anthropic’s deputy chief information security officer, said in a post on X on Thursday that the cybersecurity situation is likely to get “significantly worse” before it gets better.
“Security leaders, never let a crisis go to waste. Go to your boardroom now and ask for help,” Clinton said. “It’s not for the AI, it’s for the basics. (Must be retained for up to 18 months).”
While many large companies have access to advanced models that can be used to harden their systems, it can be more difficult for smaller companies to deal with serious bugs, Chris Krebs, former head of the U.S. Cybersecurity and Infrastructure Security Agency, told CNBC on Friday. He encouraged small and medium-sized businesses to “continuously” scan for vulnerabilities and deploy patches or take legacy systems offline as soon as possible.
“This is a critical week or two for cybersecurity,” Krebs said on CNBC’s “Squawk Box.” “As I mentioned earlier, 3% of all critical vulnerabilities ever discovered were discovered in the last month.”
Figma’s Milinovich recommended that individuals set up two-factor authentication “on everything,” use a password manager, set up an identity protection app, and move smart devices into their networks. He added that people need to lean in and experiment with AI to understand how powerful the tools have become.
“While I still strongly believe that AI will be a net positive for humanity, it is clearer than ever that the societal and personal risks are very real and prevalent now,” Milinovic said.
Krebs added that company leaders and employees need to check on their security teams.
“Make sure they’re okay,” he said. “They’ve had a tough week.”
—CNBC’s Isabel O’Brien contributed to this report
WATCH: Chris Krebs on AI for finding cyber vulnerabilities: It’s going to get worse before it gets better
