AI's 'Black October': Critical PHP flaws set off global security scramble
Governments and businesses around the globe are scrambling to contain the fallout after the PHP vulnerabilities leaked online.
Key points
- Cybersecurity teams worldwide are rushing to patch PHP flaws in an event called "Black October."
- Researchers found the vulnerabilities in August using advanced AI models from OpenAI and Google.
- Former CISA director Chris Krebs said 3% of all critical vulnerabilities ever found were discovered in the last month.
Cybersecurity teams around the world are scrambling to patch flaws in the PHP programming language this week, in an event being described as "Black October." Nearly 70% of all websites use PHP, according to some estimates.
Researchers at Google's Wiz and the AI firm Calif found major PHP vulnerabilities in August using advanced AI models from OpenAI and Google. By Tuesday, warnings had spread online, prompting governments and businesses globally to work to contain the fallout.
Warnings from security experts
John Milinovich, senior director of product management at Figma, wrote on X on Thursday that several dozen cyber attacks in the last two days would each have been the worst in a calendar year on their own. He said every sector, from government to education to big tech and banks, is being heavily affected.
Jason Clinton, deputy chief information security officer at Anthropic, wrote on X that the cybersecurity landscape will likely get "a lot worse" before it improves. He urged security leaders to ask their boards for help with the basics and said they need to hold on for about 18 months.
Security leaders, never let a crisis go to waste: please go to your boards and ask for help right now
— Jason Clinton
Advice for smaller companies
Chris Krebs, former director of the U.S. Cybersecurity and Infrastructure Security Agency, told CNBC on Friday that serious bugs may be harder for small- and medium-sized businesses to address than for large companies with access to advanced models. He encouraged smaller firms to scan constantly for vulnerabilities, deploy patches as fast as possible or take legacy systems offline.
Krebs told "Squawk Box" that this is a significant week or two in cybersecurity and that 3% of all critical vulnerabilities ever discovered were found in the last month. He also said leaders and employees should check on their security teams, who have had "a heck of a week."
