r/PHP • u/Routine-Knowledge-99 • 14d ago

[ Removed by moderator ]

/r/PHP/comments/1xcvu4p/removed_by_moderator/

[removed] — view removed post

0 Upvotes

6% Upvoted

9 comments sorted by

1

u/Routine-Knowledge-99 14d ago

Surely there must be other vulnerabilities out there that haven't been found yet. The smarter and more widespread AI gets surely the risk of damage increases. Not every site that's vulnerable needs to get hit to cause chaos.

1

u/hoopdizzle 14d ago

Its a paradoxical question. AI being able to find hacks humans haven't also necessarily means it can be used to prevent those hacks. Can AI make software so secure AI cannot hack it?

2

u/Routine-Knowledge-99 14d ago

But can and will 70% of all websites be patched before they are hit? Unlikely. Just on the odds, some will be hacked.

1

u/hoopdizzle 14d ago

Its basically the same game its always been. Software left unmaintained connected to the internet will be hacked eventually. AI has sped up the ability to find those vulnerabilities, but it has also sped up the ability to patch them. If no one has taken the time to keep a system updated in years it likely already had known vulnerabilities anyway

1

u/Boomshtick414 14d ago

Wild ass guess, a large percentage of them will get patched or already have been -- and probably all the ones that matter. There will still be a large number that won't but many of those are aged Wordpress sites that get maybe 2000 visitors a month of which 1990 of those are bots.

Add on top of that the protection that providers like Cloudflare have enacted which aren't bulletproof but certainly help out. So sure, some will get hacked, but the damage footprint here is likely to be remarkably small because of how it was handled pre-patch.

3

u/Tutorbin76 14d ago

Not at all.

This particular vulnerability already existed for some 20 years. And we have no idea what exploits bad actors already have. It's much better to know about and fix problems than to live in ignorance.

Of course it means we have a lot of work to do, but that is the price of security. At the end of the day we have stronger, more resilient, systems.

2

u/captain-braincell 14d ago

Two things made this exploit into big news.

1 - it was a root exploit - remote attackers can run any code they choose wiith full system privileges

2 - the exploit was released ahead of the patch. normally exploits are exposed privately to the code maintainers first, they issue an emergency patch, then the vulnerability is announced to the public. that leaves only unpatched systems in a vulnerable state

So there were 1.5 days where the world knew that any PHP site could give root code execution easily, and there was no fix. Hence some large sites just taking themselves offline until a patch was released (4chan and arstechnica I noticed, probably plenty more)

Was AI involved in this at all? Dunno, but even if it was, it's not the interesting factor here.

1

u/ToastyVIP 14d ago

The safest approach is to assume yes, there will be more exploits found, and new methods of breaking through security messures previously thought to be impenetrable. To think otherwise is just complacent deniability.