AI and Cybersecurity: Critical Vulnerabilities in PHP and "Code Red" Alert

AI and cybersecurity voices issue a joint warning as two critical vulnerabilities affect PHP infrastructure, used by 70% of websites. OpenAI claims its agents have helped detect vulnerabilities, while officials mention an immediate risk to essential infrastructures. Some are urging companies to strengthen their fundamentals without delay and suggest a timeline of about 18 months.

Heightened Warnings: From "Code Red" to an Announced "Tsunami"

Marc Benioff, CEO of Salesforce, expressed his agreement on Thursday with Jason Clinton of Anthropic, stating, "Jason is 100% right. Code red." Jason Clinton, Deputy Chief Information Security Officer at Anthropic, indicated that the situation has deteriorated over the past four days and could worsen before it improves. He issued a new warning to companies, mentioning an impending "tsunami of vulnerabilities," estimating that critical infrastructure is not prepared. Matt Shumer, an AI investor, believes we are experiencing the biggest cybersecurity moment in years. He noted that some incidents are already occurring, but the most severe scenarios have not yet materialized, while hoping they won't, even as he thinks these phenomena will continue.

Critical Vulnerabilities in PHP and Agent-Assisted Detection

Two vulnerabilities deemed critical have been uncovered in PHP infrastructure, a language present on 70% of websites. Recently, vulnerabilities have been identified, and OpenAI stated that its agents contributed to the detection of major cybersecurity flaws. Jason Clinton called on Wednesday for essential infrastructure to be secured before the weaknesses in fundamental networks are exploited. He recommends that security leaders seek assistance from their boards to strengthen the fundamentals and estimates that they will need to hold on for about 18 months.

Targeted Infrastructures and Incident Reported at Quest Diagnostics

Experts cite energy, water, and health among the sectors particularly exposed. Andrew Curran, an AI analyst, believes the threat of attacks targeting energy, food, and water infrastructures is real, that an actor is actively probing these targets, and he reacted on Wednesday to a cybersecurity advisory from the NSA regarding threatening actors. On Thursday, he also highlighted a hack at Quest Diagnostics, noting that this company serves about half of the hospitals and doctors in the United States.

What Internet Users Can Do Right Now

Matt Shumer describes swarms of AI agents attempting to infiltrate numerous publicly used sites, with possible consequences such as leaking personal information, taking over accounts through the reuse of an old password, or essential service outages lasting several days. He recommends updating all software, avoiding unknown sites during security updates, protecting bank accounts by being vigilant with received codes and links, and reducing entry points by unplugging unused connected devices and deleting unused applications. According to him, each connected device represents an additional entry point. An AI investor and former CEO of Hyperwrite, Shumer detailed these measures in an essay published on Thursday. These recommendations complement those from other analysts who are actively commenting on recent threats.