Monash University cybersecurity and software engineering experts are available to comment on an AI-discovered programming language flaw that has impacted about 70 per cent of the world wide web, including government websites in Australia.
Professor Rashina Hoda, Faculty of Information Technology
Professor Hoda is a co-author on published research looking into how AI practitioners view the impact of artificial intelligence on society, now and in the future.
Read more of Professor Hoda’s commentary.
Contact via: +61 450 501 248 or [email protected]
- AI/agent behaviour
- Human control on AI
- Impact of AI agents on society
The following can be attributed to Professor Hoda:
“A majority of websites and web-based applications across the world leverage the PHP programming language. The vulnerability identified in the language itself means all websites and web apps that leverage it are now exposed, sending the world into an emergency ‘patch frenzy’.
“One way to think of this incident is to consider a hotel with advanced security measures such as security cameras, guards, locks, etc. However, imagine that the software used by the hotel front check-in desk has a glitch whereby strangers or bad actors can access keys. This exposes the hotel to risks even though all other security measures are still in place.
“Australians can expect temporary outages or delays on some websites while the security patches are being applied. While major banks and companies typically do not rely on PHP for sensitive transactions, other businesses that depend heavily on providers such as WordPress for their websites, which in turn leverage PHP, are particularly vulnerable and will need to secure their services.
“We also need to watch out for a possible surge in scams and phishing attacks at this time that pretend to be securing our information in the wake of this incident.
“The fact that these vulnerabilities were discovered by frontier AI is good and bad news. Good news because it shows how agents can help discover critical vulnerabilities that may have escaped human eyes for decades. Bad news because hackers can use their own AI agents to exploit these vulnerabilities at speeds and at a scale typically not possible without agents.
“Ironically, the reason we now need to identify potential and hidden vulnerabilities is also due to the advanced capabilities of AI agents that expose the internet to latent and widespread harms that were previously only theoretical.
“Through our research we have observed six images of AI i.e. six ways in which the designers and developers of AI themselves see AI now and into the future. We have dubbed these images as Parrot, Companion, Wolf in Sheep’s Clothing, Saviour, Wizard, and Pinocchio. Of these, the current PHP incident demonstrates the Saviour image of AI on the one hand, and opens up possibilities for the Wolf in Sheep’s Clothing to manifest on the other.
“While supporting 'defenders' to react is commendable, it does highlight the need for tighter governance frameworks around how AI discoveries are systematically released (and not leaked) to the world. It calls for better human control over AI and a continuous assessment of its impact on society at all times.”
Professor Yang Xiang, Faculty of Information Technology
Contact via: +61 450 501 248 or [email protected]
- Cybersecurity and AI
- Securing software systems
The following can be attributed to Professor Xiang:
“Two critical flaws in the software that runs PHP websites have triggered emergency patching and precautionary shutdowns worldwide.
“These vulnerabilities in the programming language can let outsiders run code on a server. They can enable unauthenticated remote code execution, meaning an attacker may not need an account or password to access protected websites or databases.
“The Australian government has indicated that some websites were temporarily unavailable. This disruption is necessary and does not mean that the systems were breached or that information was stolen. We can see that a race to protect websites is happening worldwide.
“AI’s participation in the process is two-fold: on one hand, AI can help people uncover the danger, alongside human expertise. If the vulnerabilities are used by attackers, then it would become dangerous. On the other hand, human-led, AI-assisted security research can prevent future attacks if actions can be taken promptly.”
For any other topics on which you may be seeking expert comment, contact the Monash University Media Unit on +61 3 9903 4840 or [email protected]
