WASHINGTON \u2014 Advances in artificial intelligence (AI) are speeding up\nthe discovery of software vulnerabilities and increasing the risk of\ndisruption to internet services. The situation is seen as posing a\nserious threat to global digital infrastructure. Seven cybersecurity\nexperts interviewed by Reuters warned that it could lead to more\ndisruptions like those affecting government websites in several\ncountries this week.<\/p>\n
Research by Massachusetts-based cyber threat intelligence firm\nVulnCheck shows that the number of digital security flaws discovered has\ndoubled year on year. The research is due to be published in the coming\ndays.<\/p>\n
Cloudflare chief executive Matthew Prince said he was aware of\nseveral other serious vulnerabilities in important software. He said\nAI\u2019s ability to uncover weaknesses that had previously remained hidden\ncould make the coming months a busy period for the cybersecurity\nindustry.<\/p>\n
\u201cI think we\u2019re going to have a few years where every week feels like\nthe sky is falling,\u201d Prince said in an interview on Thursday (23\nOctober), Reuters reported on Friday (24 October).<\/p>\n
Widespread disruption to government websites in Europe and elsewhere\nsince Wednesday followed the discovery of a flaw in PHP, a programming\nlanguage widely used on the internet. System operators rushed to patch\ntheir software in anticipation of mass exploitation. Some administrators\neven chose to take their websites offline temporarily, fearing they\nwould not have time to install the fix before hackers exploited the\nvulnerability.<\/p>\n
VulnCheck researcher Patrick Garrity said the effort to patch the PHP\nvulnerability came during a week already crowded with cybersecurity\nproblems.<\/p>\n
In the same week, vulnerabilities were also disclosed in Node.js, an\nalternative to PHP, and Plex, software used for streaming services.\nThere were also security incidents involving LiteLLM, an AI gateway, and\nRailway, a software development platform. India\u2019s digital certificate\nauthority, eMudhra, was also found to be using extremely weak\ncryptographic keys, putting internet users at risk.<\/p>\n
\u201cIf we\u2019re seeing four or five things like this in one week, I expect\nthere will be more,\u201d Garrity said. \u201cI think there will be more emergency\nsituations for everything connected to the internet.\u201d<\/p>\n
AI Shortens the Time Needed to Find and Exploit Vulnerabilities<\/p>\n
The codebases underpinning modern software are vast. Programming\nerrors, or bugs that create opportunities for exploitation, can appear\nin unexpected places.<\/p>\n
Before AI advanced, finding vulnerabilities required specialist\nskills. Creating an exploit\u2014a tool for taking advantage of a flaw\u2014could\nalso take experienced professionals weeks or months.<\/p>\n
That time gave system operators an opportunity to fix vulnerabilities\nand roll out software updates in stages.<\/p>\n
AI, however, is changing that. AI models can continuously inspect\ncodebases for vulnerabilities and help develop exploits in a matter of\nhours.<\/p>\n
RunSafe Security chief technology officer Shane Fry said the\ncapabilities demonstrated by AI models in recent months had made the\nchanges under way in the cybersecurity industry clear.<\/p>\n
\u201cWhat has fundamentally and indisputably changed is the timeframe\u2014not\njust for finding vulnerabilities, but also how quickly adversaries can\nweaponise them,\u201d Fry said.<\/p>", "url": "https:\/\/jawawa.id\/newsitem\/ai-discovers-new-cyber-vulnerabilities-increasing-the-risk-of-attacks-on-websites-1792810278", "image": "" }, "sponsor": "Okusi Associates", "sponsor_url": "https:\/\/okusiassociates.com" }