The threats to our cyber security are “going to get a lot worse before they get better”, an expert has warned, amid ongoing panic over AI-powered hacking.
This week, ongoing worry about the effect that artificial intelligence could have on our cyber security became outright panic after a series of threats. Most notable was a crisis over PHP, a programming language used to power some 70 per cent of the internet and which was found to have a dangerous vulnerability that could allow hackers to take over websites.
Cyber security professionals rushed to fix those problems, which require updating every website. But the threat may be ongoing for some time, because of the complexity of the updates and the need to change websites that might be complicated or neglected.
Felix Kuhlenkamp, head of security at German digital industry association Bitkom, said that many larger operators had already carried out updates, but for complex IT systems and smaller organisations it could take longer.
“They may run a website using PHP but don’t really keep a close eye on it,” he said. “If a website is based on an old version of PHP for which there is no security update, the entire system must be updated.”
Others suggested that the problems with PHP are just a hint at the perilous state of cybersecurity, and warned that there will be many more threats to come as models become more powerful and widely available.
Jason Clinton, chief information security officer at Anthropic, said that a “vulnerability tsunami is coming in just a few months and there won’t be enough time to patch critical infrastructure”. He pointed to a notice from the US National Security Agency that was released in response to a specific vulnerability in systems made by Siemens.
That included not just the usual advice of ensuring that software was up to date, for instance, but also a warning to ensure that critical devices are not connected to the internet. Mr Clinton said that such “network isolation” is “needed now”.
“As bad as things have gotten in the past four days, they are going to get a lot worse before they get better,” he wrote on X. “Security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. Not for AI, for the basics.”
As more attacks come, companies may not even understand the systems that they are relying on and need to protect against the growing threat, warned Raj Rajarajan, director of the Institute of Cyber Security at City St George’s, University of London.
“In the age of AI, we are going to see more of these types of attacks, as threat intelligence software have multiple AI agents for threat hunting. These will be working in the background and will penetrate systems where they identify a backdoor,” he said.
“The challenge will be to protect legacy technologies, as many organisations may not know all their in-house technologies. Even if they know, they may not have the people with skills to address those legacy technological challenges.
“The speed at which AI transformation is happening is worrying, and we need to have good guardrails in place to stop these kinds of vulnerabilities escaping and getting into cyber criminals’ hands.”
Read MoreHow a cyber crisis could affect banks and why you need a cash supply
What is PHP and why has it caused chaos for millions of websites?
Websites across the internet go down as hackers launch millions of cyber attacks
OpenAI agents disabled their own safeguards and then lied about it, company admits
AI systems could hack their own companies from the inside, Microsoft warns
