The PHP emergency: How AI has changed hacking forever - BBC Africa — Transcript

Full transcript

1. 0:00Hacking is a bit like navigating
2. 0:02a complex maze.
3. 0:04You have a feeling there's a way to
4. 0:06get inside, but you're not
5. 0:08sure.
6. 0:12Trial, error, and
7. 0:14creativity is what separates a
8. 0:16skilled hacker from the pack.
9. 0:18But with AI, things have changed.
10. 0:20Hackers can now move faster,
11. 0:22be more persistent, more
12. 0:23knowledgeable.
13. 0:24And with AI agents,
14. 0:26there can be simply more of them.
15. 0:30The 2026 PHP emergency
16. 0:32highlights perfectly how AI
17. 0:34has changed internet security
18. 0:36forever.
19. 0:37The story starts in 2024
20. 0:39when cyber researchers had a
21. 0:41feeling there was a path to
22. 0:43hack the popular programming
23. 0:44language, PHP,
24. 0:46which powers millions of websites.
25. 0:49But the researchers couldn't
26. 0:50actually find a way in other than
27. 0:52in theory.
28. 0:53Fast forward two years later though,
29. 0:55and AI has become exceedingly
30. 0:57good at hacking.
31. 0:58Researchers carrying out a security
32. 1:00audit used AI agents
33. 1:02to find a way through the digital maze.
34. 1:04This audit without
35. 1:06AI, this would have been months.
36. 1:08And we had something in
37. 1:10six days or something, I think.
38. 1:12Ryan Austin is the PHP expert
39. 1:14who found the path using AI.
40. 1:16So I had a good hunch of where this was.
41. 1:18I was able to ask the
42. 1:20agents and it was able verify
43. 1:21what I had already thought of.
44. 1:23Large swathes of the world's
45. 1:25internet last night became suddenly vulnerable.
46. 1:28This security flaw was
47. 1:29discovered by AI.
48. 1:30Flaws in a programming language which
49. 1:32powers much of the internet.
50. 1:34Website after website being taken offline.
51. 1:36Hundreds, maybe thousands of
52. 1:38websites were taken offline as a
53. 1:40precaution and warnings were issued
54. 1:42around the world about the potential danger.
55. 1:44PHP's vulnerabilities are the most serious found
56. 1:47since AI became prevalent in cybersecurity research.
57. 1:50But they're also a drop
58. 1:52in the ever-expanding ocean.
59. 1:54This graph shows the number of
60. 1:56vulnerabilities found since ChatGPT
61. 1:58was launched and AI started being used in cyber.
62. 2:01Highly severe bugs are those in pink
63. 2:03and critical ones are those in turquoise.
64. 2:06Things were pretty steady as you can see
65. 2:08but look what happened in Spring 2026
66. 2:10when models like Claude Mythos emerged.
67. 2:13AI has been an absolute
68. 2:15game changer.
69. 2:16You can give it a task and it will
70. 2:18keep going until it
71. 2:20figures out the answer.
72. 2:21On the surface of it, this tells us
73. 2:23a positive story.
74. 2:25AI is finding hidden pathways into
75. 2:27software that modern life relies on.
76. 2:29So now we can go out and
77. 2:31fix it all to stop the bad guys
78. 2:32hacking stuff.
79. 2:34But take a look at this.
80. 2:35This data is from the US cyber
81. 2:37agency.
82. 2:38It shows vulnerabilities that are
83. 2:39being actively exploited by
84. 2:41actual criminals in the wild.
85. 2:43So as you can see, this graph tells
86. 2:46a different story.
87. 2:47The number that attackers are
88. 2:49actually using
89. 2:50is the rather more important figure
90. 2:53and they're not trending into quite
91. 2:55as much use as the level of overall
92. 2:57vulnerability discovery.
93. 2:58The challenge then is that
94. 3:00legitimate cyber security defenders
95. 3:01have to roll out patches to those
96. 3:03problems so attackers can't break
97. 3:05into their environment and it's
98. 3:06causing a lot more work.
99. 3:08Which takes us back to PHP and
100. 3:11another important lesson in
101. 3:12how AI is changing internet
102. 3:15security.
103. 3:15Once the vulnerabilities were
104. 3:17discovered, the plan was to secretly
105. 3:19make a fix for them and then calmly
106. 3:21release it so that those millions of
107. 3:23sites could update before the bad guys.
108. 3:25But that didn't happen.
109. 3:27Panic spread with rumors that
110. 3:29criminals were using AI to come up
111. 3:30with ways to hack PHP.
112. 3:32'Install the software patch now
113. 3:34or take your website offline.'
114. 3:36That was the warning and many people
115. 3:38did it was an incredible public
116. 3:40response i've never seen anything
117. 3:41like it but the truth is
118. 3:43that no, criminals weren't
119. 3:45running around with an AI-made
120. 3:47exploit ready to hack everybody
121. 3:49It took nearly a week for the php
122. 3:51vulnerability to make it onto the
123. 3:53same list showing actual criminal attacks.
124. 3:56Now that's not to say it wasn't serious.
125. 3:58I mean, AI combined
126. 3:59with a skilled security researcher
127. 4:01found a really nasty defect
128. 4:04that could be used by the attackers.
129. 4:06It turned out to be a little harder
130. 4:08to exploit than people kind of
131. 4:10expected.
132. 4:11So I think it was a great example of
133. 4:12something serious that was
134. 4:14overplayed and we've got to be
135. 4:16careful not to be the boy who
136. 4:18cried wolf.
137. 4:19So criminals aren't yet jumping on
138. 4:21these new AI-found vulnerabilities,
139. 4:23but are they using AI to find their
140. 4:25own pathways into organisations?
141. 4:28Yes, but slower than you might
142. 4:30think.
143. 4:31If we think about social
144. 4:32engineering, if we think about
145. 4:34their usual pathways to gaining access to
146. 4:36organisations, a lot of them have
147. 4:38tried and tested methods that
148. 4:40they're just pushing over and over again.
149. 4:42So the need for AI
150. 4:43hasn't really come up as much
151. 4:45as our defender need to
152. 4:47use it to best protect, detect, and
153. 4:49respond.
154. 4:49Another aspect to AI and cyber
155. 4:51is the rise of out of control
156. 4:53AI agent attacks.
157. 4:56The now infamous Hugging Face attack
158. 4:57by OpenAI agents has shown
159. 4:59that another player has entered the field.
160. 5:01I think we can't
161. 5:03shy away from the fact that
162. 5:05cybercriminals and threat actors are
163. 5:07getting more and more comfortable
164. 5:09with artificial intelligence.
165. 5:11They are learning quickly.
166. 5:12And so I do think over the years to
167. 5:14come, we will see more of them
168. 5:16embracing AI as part of
169. 5:18their toolkit and as part of the way
170. 5:19they work.
171. 5:20And so that will filter through
172. 5:21naturally into the types of
173. 5:23cybercrime and activity that we're
174. 5:24seeing.
175. 5:25The last six months of AI
176. 5:26advancements has thrown up new
177. 5:28challenges and opportunities for
178. 5:30internet security, and no doubt
179. 5:32more will come as we try and
180. 5:33navigate this complex and fast
181. 5:35moving AI world.