A flaw in PHP is taking down websites. Is the internet at risk? | BBC News — Transcript

Full transcript

1. 0:00Cybersecurity experts warn this could be
2. 0:01the largest vulnerability they've ever
3. 0:03had to patch. [music]
4. 0:04>> Two major flaws have been discovered in
5. 0:06an extremely popular programming tool
6. 0:08called PHP.
7. 0:10>> It's estimated about 70% of all websites
8. 0:12[music] use what's known as PHP.
9. 0:15>> If exploited, it could allow attackers
10. 0:17to take over internet servers.
11. 0:19>> If nothing is fixed, [music] they could
12. 0:20access medical records, they could
13. 0:22access, you know, all the information
14. 0:24that we like to keep nice and secure.
15. 0:26>> 32 [music]
16. 0:28government services here in the UK are
17. 0:30now offline.
18. 0:31>> The vulnerability was made public,
19. 0:33hackers
20. 0:34>> [music]
21. 0:34>> immediately tried to exploit it.
22. 0:36>> Well, this is extremely serious.
23. 0:43>> Organizations around the world have been
24. 0:45scrambling to protect their websites
25. 0:47from attacks after what has been called
26. 0:49an unprecedented flaw was found in a
27. 0:51programming language that runs much of
28. 0:53the internet.
29. 0:55Over the next 10 minutes, we'll explain
30. 0:56what PHP is, the role AI had in
31. 1:00discovering the flaw, how hackers are
32. 1:02trying to exploit it, and ask just how
33. 1:04vulnerable is the internet.
34. 1:07Let's start with PHP. You, like me, may
35. 1:10never have heard of it until news of the
36. 1:11flaw became public. So, what is it?
37. 1:14Here's our cyber correspondent, Joe
38. 1:16Tidy.
39. 1:17>> PHP stands for Hypertext Preprocessor,
40. 1:19which is a very popular language that's
41. 1:22used in coding. Most websites in the
42. 1:24world, the vast majority of them, have
43. 1:26some sort of PHP in their stack. So,
44. 1:28this is the kind of stuff that happens
45. 1:30invisible to us. We don't even know that
46. 1:31websites use it, but by the sounds of
47. 1:33it, we are all reliant on it every day
48. 1:35without even realizing.
49. 1:36>> So, how was the flaw found, and what
50. 1:39role did AI play? Back to Joe.
51. 1:41>> This all goes back to 2024, actually,
52. 1:43when the PHP Foundation, which is the
53. 1:45non-profit that runs and maintains the
54. 1:47PHP language, they had an idea that
55. 1:49there might be a problem with their
56. 1:51coding language. There might be a flaw.
57. 1:53And they started thinking about it as a
58. 1:55potential theoretical vulnerability, but
59. 1:57they couldn't really work out whether or
60. 1:59not any human being would actually be
61. 2:00able to carry out an exploit to make it
62. 2:03effectively, you know, lead to cyber
63. 2:05attacks. So, they kind of parked it, but
64. 2:07then AI came along, of course, and
65. 2:08earlier this summer PHP [music] was
66. 2:11inducted into a program that's run by
67. 2:13OpenAI
68. 2:15and they use AI to scan
69. 2:18software and in this in this case the
70. 2:19coding language for flaws and then use
71. 2:21AI to also patch any problems. And it
72. 2:24was discovered then that yes, there was
73. 2:25a way that this vulnerability could be
74. 2:28used by hackers to lead to really
75. 2:30serious cyber attacks. So, OpenAI along
76. 2:33with a company called Kaliff and a
77. 2:34company called Wiz that are
78. 2:35cybersecurity experts, they discovered
79. 2:37this vulnerability and another one and
80. 2:39that's what led to this panic really
81. 2:42because of course, it wasn't just them
82. 2:43that discovered it. Someone leaked the
83. 2:45fact that there might be this
84. 2:46vulnerability out there, which led to
85. 2:47[music] cyber criminals using AI
86. 2:50themselves to try and work out what that
87. 2:52pathway to success would be, which has
88. 2:54[music] been the reason why lots of
89. 2:56companies and organizations around the
90. 2:57world have sort of panicked really and
91. 2:59tried to patch or take their websites
92. 3:00offline.
93. 3:02>> And what could happen if the flaw isn't
94. 3:04fixed on a website? Alice Taylor is scan
95. 3:06researcher at Oxford Information Labs.
96. 3:09>> If nothing is fixed, attackers
97. 3:12could be able to sort of run their own
98. 3:15commands on any server and that
99. 3:18essentially means they've sort of got
100. 3:20the keys to
101. 3:22a million different locks. Um they could
102. 3:25access records, they could access, you
103. 3:28know, all the information that we like
104. 3:29to keep nice and secure.
105. 3:32>> The UK's National Cyber Security Centre
106. 3:34says the flaw affecting millions of
107. 3:36websites is unprecedented. Joe's been
108. 3:38looking at the impact online.
109. 3:41>> The impact we've seen is very visual and
110. 3:42that's highly unusual, of course, for
111. 3:44cyber security. We've seen government
112. 3:47websites in the UK, 32 different
113. 3:49government services have been taken
114. 3:50offline. We've seen websites in the
115. 3:52Netherlands and France and
116. 3:56Finland be taken offline as well because
117. 3:58the issue here is that if you can't
118. 4:00install that the fix that that makes
119. 4:02your website and your PHP secure, then
120. 4:05you need to take your you need to take
121. 4:06yourself out of the running because of
122. 4:07course there is a race going on right
123. 4:09now between cybercriminals using
124. 4:11potential AI attacks
125. 4:13>> [music]
126. 4:13>> against companies and organizations that
127. 4:15have vulnerable websites that have PHP
128. 4:18this kind of flaw built in. So, lots of
129. 4:20companies have taken their websites
130. 4:21offline while they're trying to handle
131. 4:23this.
132. 4:24>> So, if you have a website, what's the
133. 4:25advice to protect yourself not just now
134. 4:28but in the future? Dr. Megha Kumar is
135. 4:30founder and CEO of PerceptiLabs.
136. 4:33>> The key point here is that software
137. 4:35patching has got to become a regular
138. 4:38discipline that every company has to
139. 4:39take. And you know, with this particular
140. 4:43software, we know the hackers can
141. 4:45execute commands remotely. So, patching
142. 4:48the software is absolutely essential as
143. 4:51is prioritizing
144. 4:52your assets that are internet-facing. If
145. 4:55you cannot fix them right now, I would
146. 4:57recommend you take them offline
147. 4:59temporarily to keep your estate safe.
148. 5:01Then look for signs of compromise. Are
149. 5:03there sort of
150. 5:04you know, any traces of a compromise
151. 5:07across your network?
152. 5:09>> Let's hear now from the man who
153. 5:10discovered the flaw, cybersecurity
154. 5:12researcher Ryan Austin.
155. 5:14>> I always like to be, you know, up front
156. 5:17that all these vulnerabilities that we
157. 5:19found are patched. There
158. 5:21could be other vulnerabilities that are
159. 5:23unrelated, obviously.
160. 5:25You know, and now that now that the
161. 5:27floodgates have kind of been opened with
162. 5:29this vulnerability as well,
163. 5:31a lot of other people are going to start
164. 5:32looking to see what else is there.
165. 5:36>> Ryan used AI to help discover that flaw.
166. 5:39Jinan Ef who's professor of responsible
167. 5:41AI at Queen Mary University London says
168. 5:44this really is a good news story.
169. 5:47>> This um, vulnerability, as we say in the
170. 5:50jargon,
171. 5:51has been found early enough to create
172. 5:54the patch, the fix that it needs in
173. 5:57order to make sure that most people can
174. 6:00update their systems and be safe. So,
175. 6:04this could have been a bad news story,
176. 6:06but instead we can celebrate that there
177. 6:07are people working really diligently on
178. 6:10making sure that they're using AI tools
179. 6:13for good [music]
180. 6:14to keep out the people who would use
181. 6:16them for harm. This story has been
182. 6:17months in the making because [music]
183. 6:19we've known with the latest release of
184. 6:21very powerful models from both OpenAI
185. 6:23and Anthropic that they had these
186. 6:25cybersecurity implications, and they've
187. 6:27been working with governments around the
188. 6:29world to make sure that we get on the
189. 6:32front foot of cybersecurity, not on the
190. 6:34back foot.
191. 6:35>> And with so many of us relying on
192. 6:37websites every single day, just how
193. 6:39vulnerable is the internet, and how
194. 6:41worried should we be? A question for our
195. 6:43reporter, Kevin Yewen.
196. 6:45>> You should be worried because you should
197. 6:47have always been worried. What this
198. 6:48latest incident with PHP reveals is how
199. 6:51fragile the underlying architecture of
200. 6:53the internet actually is. Web servers
201. 6:55and apps rely on tools sometimes
202. 6:57maintained by small groups of people or
203. 6:59even just one developer.
204. 7:01What AI frontier models are currently
205. 7:03doing is not creating new forms of
206. 7:05digital attacks, but accelerating the
207. 7:07discovery of historic flaws already
208. 7:09baked into the code.
209. 7:10Whether this is a good or a bad thing
210. 7:13depends on who who is doing the work.
211. 7:15In cybersecurity, there's a concept
212. 7:16called assumed breach. That is, you
213. 7:18should operate as if you're already
214. 7:20compromised, then work to prove that
215. 7:22you're not. And that is the way everyday
216. 7:24users like you should behave with their
217. 7:26data.
218. 7:27>> Dr. Rumman Chowdhury, responsible AI
219. 7:30fellow at Harvard University and the CEO
220. 7:32and co-founder of Humane Intelligence,
221. 7:35says there needs to be more investment
222. 7:37to protect us all.
223. 7:38>> This type of vulnerability, obviously
224. 7:40the one at the scale is quite massive.
225. 7:42It's a it's a level one vulnerability,
226. 7:44but you know, there's vulnerabilities
227. 7:45all the time and often it is identified,
228. 7:48patched, and fixed while we are sleeping
229. 7:51by people who are often unpaid to do the
230. 7:53work. So yes, I would love to see more
231. 7:55investment in just core cybersecurity,
232. 7:58good data hygiene, and also compensating
233. 8:01or funding the organizations that have
234. 8:03built so much of the everyday
235. 8:05infrastructure on the internet that we
236. 8:07depend on to lead our normal lives. As
237. 8:09you've mentioned banking is being
238. 8:11disrupted. I I don't know how any of us
239. 8:13can would be able to exist without just
240. 8:15the basics of being able to transact and
241. 8:17here we are dependent on a completely
242. 8:19free software to do that.
243. 8:22>> So finally, could we see more flaws like
244. 8:24this in the future? Back to our cyber
245. 8:26correspondent Joe Tidy.
246. 8:27>> I think what we're seeing with PHP is a
247. 8:29real case study of what is happening
248. 8:32with artificial intelligence and
249. 8:33cybersecurity. We know that AI has
250. 8:36become extremely capable at hacking.
251. 8:39That's good and bad. So this case is a
252. 8:41really good study of what what we can
253. 8:43see of things going well. So AI was used
254. 8:45to find a a cybersecurity vulnerability
255. 8:47that until now no one really knew was
256. 8:50there. The researchers that discovered
257. 8:51this said that this was right on the
258. 8:53edge of what humans could be capable of.
259. 8:56It's a really complex chain of actions
260. 8:58that an attacker would have to take to
261. 9:00get into PHP. In effect what they're
262. 9:03saying is, you know, the AI helped them
263. 9:04work out that if you do this, this,
264. 9:06this, and this in a particular order,
265. 9:07then you can hack a website. So AI is
266. 9:10being used in a really good way to help
267. 9:12defend organizations like PHP, but then
268. 9:14we see of course AI being used by the
269. 9:16bad guys as well trying to come up with
270. 9:18their own methods to carry out a hack
271. 9:20because they've heard the the rumor that
272. 9:22PHP has a vulnerability.
273. 9:24>> And that's the cybersecurity flaw
274. 9:26explained.