Jerry Kaplan at Persuasion:
Two days ago, elite computer security experts announced the discovery of a critical vulnerability hiding in plain sight—one embedded in PHP, the software that powers an estimated 70% of the world’s websites. This bug allows bad actors to execute programs on the target machines, which is to say, take them over and do with your data as they please. The discovery instantly set off a mad scramble to patch the problem (just getting underway), as well as a nefarious effort by bad actors to exploit the bug for fun and profit before it gets fixed.
Key to the plot are firms with suitably obscure names—Wiz and Calif. Both firms are straight out of central casting. Wiz is a giant Google-owned company founded by Israeli military intelligence veterans to help major companies secure their computer systems; Calif is an elite boutique cybersecurity firm that employs an international cadre of hackers and is deeply integrated with the top AI labs to help them test their products for vulnerabilities.
Wiz and Calif were using different advanced AI tools to run tests on PHP when they each independently discovered a flaw that had been lurking in the software for more than a decade. While the bug itself had been spotted as far back as 2020, researchers had mistakenly thought that it could only cause a software crash. But the plot twist was that the AI tools were able to show it could be weaponized to take over the entire machine, making the threat widespread and urgent—something that they estimated would have taken a team of human experts months to discover on their own, if ever.
More here.
Enjoying the content on 3QD? Help keep us going by donating now.