By alerting organizations worldwide to a security flaw in software used by the majority of companies, AI has inadvertently opened a huge backdoor for the world's cybercriminals. By revealing critical security flaws in PHP software, the disclosure is effectively a starter gun for threat actors, with small businesses now becoming exceptionally easy targets for all types of cyber-attacks.
PHP, originally standing for Personal Home Page, is a software developed at the dawn of the internet that has evolved into a widely used, open-source server-side scripting language designed for web development and a range of other products. PHP is used by almost 70 per cent of websites, according to cybersecurity firm Cloudflare.
When the security flaw was initially discovered last Thursday, Qualys, a California-based cloud security and compliance company, found 167 million PHP package installations across 12,000 organizations, with 73 per cent deployed on internet-facing assets, putting them within reach of remote attackers.
"A critical security issue"
The UK's National Cyber Security Centre (NCSC) is now urging all organizations to address what it terms "a critical security issue that may allow attackers to execute commands on any web server running PHP."
The NCSC is also going so far as to tell those organizations who lack the resources to fix the flaws immediately that they should take their system offline immediately until it can be fully mitigated — a stark warning reminiscent of guidance issued around critical infrastructure modem flaws and open-source vulnerabilities in Chrome.
"If you are unable to update or disable the system immediately then you should assess the system for any evidence of compromise prior to your upgrade or mitigation and look for backdoors installed by an attacker," adds the NCSC. The NCSC is also offering companies assistance from an NCSC-assured Cyber Incident Response provider to help cope with the increasingly widespread security crisis.
Most small businesses have never even heard of PHP
It remains to be seen how many organizations will be compromised as a result of the PHP security flaws and suffer potentially devastating cyber-attacks. The risk is most acute where small businesses are concerned. According to a survey carried out by US-based web hosting service Network Solutions, 71 per cent of small businesses had not even heard of the recent PHP security flaws. Almost half — 45 per cent — had never even heard of PHP. Only 10 per cent acknowledged that their website was affected, and only half of those have actually completed the fix.
This is consistent with a broader pattern of small and mid-sized businesses being caught unprepared by major security events. Research has previously shown that 73 per cent of SME security professionals failed to act on a high-priority security alert, and that unsanctioned AI adoption is leaving companies increasingly vulnerable to exactly these kinds of cascading threats.
Coupled with the widespread adoption of largely untried AI services across all sectors, the internet's growing raft of major security flaws and the increased effectiveness of threat actors may soon cause companies to regret their over-reliance on digital services. The PHP disclosure also raises uncomfortable questions about the role of AI in responsible vulnerability disclosure — and whether speed of revelation is always in the public interest when smaller organizations lack the capacity to respond in time.
