Is AI helping or harming cyber-security amid the PHP hacking attempts | Global News Podcast

This is the global news podcast from the. BBC World Service. I'm Charles Havland. and today is AI helping or hurting cyber. security? Artificial intelligence has. uncovered a major flaw in the software. used to make websites and hackers have. used AI to make millions of attempts to. exploit it. We'll hear from a cyber. security expert. >> Using this exploit on someone's website. is essentially getting into their front. door, maybe the gate to their property. and ask our tech reporter about the.

impact. >> If you can remember Y2K and the race to. fix that, it's sort of like that's. happened, but it's happened in a. somewhat unplanned way. >> Thus, we'll ask our cyber correspondent. about the power and the danger of AI. >> So, yes, AI did a good thing. It spotted. something that that humans couldn't. But. then, of course, we see the the. fallibility of it. Governments, businesses, and other organizations. around the world have been scrambling to.

protect their websites from attacks. after a major security flaw was found in. the programming language called PHP, which runs much of the internet. The. cyber expert Ryan Austin spent 20 years. researching PHP security, but it was. only with the help of AI that he was. able to uncover this weak spot. He. described it as the most serious. vulnerability I've ever found. using this exploit on someone's website. is essentially getting into their front. door, maybe the gate to their property,

right? And now they have access to the. rest of that property and now they're. free to go. around inside of the network and they. can do things like ransomware and all. kinds of really bad things. You know, I. I always like to be, you know, upfront. that all these vulnerabilities that we. found are patched. There could be other. vulnerabilities that are unrelated. obviously, you know, and now that now that the. floodgates have kind of been opened with.

this vulnerability as well, a lot of. other people are going to start looking. to see what else is there. >> Our cyber correspondent Joe Tidy told me. more about this cyber security flaw and. what it means for websites. >> These were just some of the error. messages greeting people as they tried. to access websites around the world. In. Japan, Belgium, France, the Netherlands, and the UK, sites and pages have been. taken offline, including some BBC ones. But the outages aren't due to a cyber. attack. They're to prevent one. Two.

major flaws have been discovered in an. extremely popular programming tool. called PHP used by millions of websites. Stark warnings about the potential. impact have been issued by cyber. authorities, including the UK and the. US. If nothing is fixed, attackers. um could be able to sort of run their. own commands on any server. And that. essentially means they've sort of got. the keys to a million different locks.

Um they could access medical records. They could access, you know, all the. information that we like to keep nice. and secure. PHP was alerted to the flaws. by cyber researchers, including from. OpenAI, who used AI to find the complex. vulnerabilities. [music]. A plan to issue a fix was in the works, but then this clip from an anonymous. hacker circulated on social media. It. gave clues about how the PHP hack could.

be done. That set off a panic as it. became clear that criminals might soon. be able to attack PHP websites before. they could be protected. So now the race. is on for cyber defenders to download. the security fixes before the hackers. are able to break in. Joe tidy there. Well, this story has highlighted the. positive power of AI being used to. diagnose security problems and its. potential for misuse by hackers probing. for vulnerabilities. We asked Joe what.

he made of it all. This could have been. and should have been a good news story. about AI because in 2024 the PHP. Foundation that runs this programming. language, it's a nonprofit. They kind of. maintain the language. They thought that. they might have found a problem with. their coding system that may have may. lead to cyber attacks. So they thought, okay, maybe there's a theoretical. problem here, but we can't work out any. how any human could actually do it. So. they kind of parked it and thought, hopefully that's not a problem. Along. comes AI, OpenAI, and a company called. Calif and a company called Whiz. They.

use frontier models to probe PHP to see. whether or not there were any. vulnerabilities. And they found that. yes, that particular pathway is possible. in a really complex chain of action. So. if you do this, this, this, and this in. this particular order, you might be able. to hack a website. So yes, AI did a good. thing. It spotted something that that. humans couldn't. But then of course we. see the the fallibility of it because. humans have accidentally leaked the. information and that's led the bad guys. to use their own AI to figure out how. that the hacks could be possible. And.

that's what's launched this kind of wave. of potential probes and attacks against. websites that haven't yet patched. It. shouldn't have been like this. It should. have been much more civilized, but it. wasn't. As you heard earlier, the PHP. security flaw can be fixed or patched as. cyber experts say, but this has still. caused a massive headache for the many. governments, banks, airlines, and other. organizations that depend on this. technology to run their websites. And. consumers who use those sites have been.

asking whether their data could be at. risk. We got the details from our tech. reporter, Chris Valance. PHP is one of. these technologies that is used so. widely and I think one of the key. challenges will be for uh organizations. to actually try and find out all the. systems that they have that rely upon. PHP and it's not just going to be if you. like the the the obvious things the the. public facing websites it might also be. systems that are perhaps uh less uh.

highly visible but nonetheless critical. for example say in engineering control. systems where there's a web page that is. the sort of access point for that. Uh. that will systems like that will need to. be addressed and also they'll need to. figure out what to do about versions of. PHP that uh are too old to be updated. Um there's just there's going to be this. huge hunt for uh the PHP that's. operating on their systems depend upon.

PHP and a race to fix it. I mean what. you're going to see is some disruption. uh as uh sites are taken down as a. precautionary measure. We've seen a fair. bit of that um in terms of the. proportion of sites that people visit. Uh you know I think that impact is going. to be sort of sporadic. Um in terms of. uh data at risk I mean this is the key. concern because you've got this huge. task. I mean it's almost a bit if you. can remember Y2K and the race to fix.

that. sort of like that's happened but. it's happened in a somewhat unplanned. way. So there is this race on uh and you. know the concern is that if stuff isn't. updated isn't up fix isn't fixed that is. an open door to hack a so I think the. anxiety about your data is one that uh. uh you know we'll have to we'll have to. live with for a little bit. We'd like to. bring you one more story now because. Israel is just days away from its first. general election since the deadly.

Hamasled attacks three years ago. Prime. Minister Benjamin Netanyahu has said. that a vote for him is a vote to end the. Iranian regime and ensure the eternity. of Israel. But polls suggested either he. or his main opponents will struggle to. form a governing coalition and that. could leave the smaller Arab majority. parties holding a critical balance of. power. Our Middle East correspondent, Yoland Nell, reports now on what Israeli. Arabs, also known as Palestinian. citizens of Israel, want from this.

election. >> A drive to get out the vote among Arab. or Palestinian citizens who make up a. fifth of all Israelis. While disaections. often push down past turnout, this. election, many want change. Israel's Supreme Court overruled. attempts to disqualify Arab parties. Angry reactions showed the rise in. mistrust and hostility. After October 7, we were treated as.

enemies for this country. There was. major arrests. There was firing people. from their workplaces because they put. something on social media or they went. out against the war on Gaza. Arab-Israelis are mostly descendants of. Palestinians who remained on the land. which became Israel in 1948. This Israeli government often frames. them as a threat to the state's Jewish. identity. At Radio NAS in the Arabic language.

station in Nazareth, they report on the. impact. In one word, it's racism because the. political interest of Benjamin. Netanyahu, he's trying all the time to. pull maybe the legitimacy of Arab. parties because they are are Arab, because they are Palestinians. >> All the main right-wing contenders. currently rule out a coalition with the. two Arab majority lists. But will that. last? If you look at the polls, there's. no clear path to a parliamentary.

majority for either the Netanyahu block. nor the main opposition block. Either. the anti-Netanyahu parties have to go. back on their pledge not to join a. coalition with him or after the election. they have to make a deal with Israel's. Arab parties. The joint Arab List says. it's ready to vote with a coalition that. ousts Mr. Netanyahu. But Islamist Mansur. Abbas joined a previous short-lived. coalition and wants to be in the next. government.

Our approach has been driven by a desire. to reach a position of influence, not. just representation and to offer hope to. both Arabs and Jews. In this election, Arab citizens could yet decide who. wields power in Israel. And they also. see this vote as key to their own future. in the country. But that's all for now. To hear more. about any of the stories we covered. today, you can find the audio version of. the Global News podcast wherever you get. your podcasts. If you'd like to get in.

touch, our contact details are below. I'm Charles Havland. Until next time, goodbye.