The Pressing Need for Timely Cybersecurity Alerts

You might not be familiar with PHP2Shell, but students in a cybersecurity class are. Recently, a lecture was modified to address this issue—a set of vulnerabilities in PHP, a programming language behind a majority of websites. These flaws were present since at least 2012, until recently uncovered by a researcher using an AI model. PHP’s maintainers issued a patch on October 21. Despite this, some attacks had already occurred, and a patch only works if it’s applied.

AI can now analyze a patch to identify and exploit the vulnerability it addresses, a task once possible only for intelligence agencies or elite hackers. However, defenders have lagged. Qualys found 167 million PHP installations on its customers’ systems. Within 12 hours of disclosure, only a small fraction had been updated. This gap could last weeks.

On October 27, Anthropic revealed that its Claude model had devised an exploit targeting some Linux servers through a vulnerability in network connection handling. Though Linux developers patched it on October 5, by November 2, no fix had been released for Ubuntu, a popular Linux server OS. Unpatched vulnerabilities frequently lead to harmful attacks.

In March 2017, the Apache Software Foundation patched a vulnerability in Struts, software used to build sites. Equifax, failing to install the patch, suffered a breach resulting in the theft of personal data from 147 million Americans.

Using Media Cloud, a news archive, coverage of 25 major cyber events and the Struts patch was analyzed. In the eight days post-notification, no national outlet featured a story. The massive Equifax breach did appear in some stories, but the patch overlooked. The media often reports on disasters but not forecasts or solutions. Recent data shows New York Times, Washington Post, and Wall Street Journal provided limited coverage of PHP2Shell.

The large number of vulnerabilities each week is concerning. During the week of October 12, a record 5,461 were reported. While most interest specialists, some have wider impact. A few incidents from 2010 to 2021 received little media attention, even when relevant to the public.

The increase in vulnerabilities can be attributed to more powerful AI systems. While beneficial in long-term security, they present short-term threats due to increased unpatched exploits. Similar to the National Weather Service issuing storm watches, CISA should alert the public about significant software vulnerabilities.

Congress, commencing in January, will face decisions on AI’s development and security measures. Even AI companies are concerned. Jason Clinton of Anthropic remarked on the deteriorating situation, urging leaders to seek assistance.

AI modifies the threat landscape rapidly, but human action remains key. Without communication on such risks, necessary measures may not be taken. Equifax had ample time to apply its patch, unlike PHP2Shell’s sudden threats. Timely alerts to the public are crucial, much like impending severe weather warnings.