Editorial: Critical PHP vulnerabilities demand action to keep the internet safe

Critical flaws have been found in the PHP programming language, forcing many companies and government agencies to temporarily suspend their web services and websites.

The vulnerabilities are among the most serious ever discovered in terms of their potential impact. Systems must be put in place without delay to safeguard the internet.

PHP is used to create programs that retrieve information online and provide responses based on user input. It is employed by roughly 70% of the world's websites. If cyberattacks exploit the flaws to seize control of systems, websites could be altered and confidential information stolen.

The organization overseeing PHP has released security patches and urged users to apply them promptly. Cybersecurity giant Trend Micro Inc. has confirmed attacks exploiting the vulnerabilities on multiple servers in Japan.

The incident has highlighted how artificial intelligence (AI) can serve both as a guardian of the internet and as a threat to it.

The vulnerabilities had existed for more than a decade but remained unaddressed. This time, U.S.-based OpenAI and other organizations used cutting-edge AI to identify them within a short period.

Conversely, this means AI can easily be misused to discover new flaws and use them in cyberattacks. Traces of AI-assisted attacks have been detected in some cases of unauthorized access that have surged since September.

Serious flaws are likely to emerge in a wide range of systems beyond PHP. Companies and other organizations need to use AI to strengthen their defenses while promptly applying security patches. If they fail to remain vigilant and allow personal data to be leaked, their customers and business partners could suffer serious harm.

Many small and midsize companies leave the development and operation of their systems entirely to outside contractors. It is not uncommon for such businesses to lack cybersecurity personnel or to allocate inadequate funds for security measures. Corporate executives must change the way they view the issue.

The Japanese government has a particularly important role to play. It should strengthen its frameworks for sharing information with the United States and other countries leading AI development, and for ensuring that necessary countermeasures are widely communicated. Supporting businesses with limited resources is an especially urgent task. The government must draw lessons from this incident.

Japan to launch team of white-hat hackers to counter waves of cyberattacks

What to know the AI-detected security bug impacting wide swaths of the internet

Japan gov't sites partially suspended as patching of PHP flaws underway

Megabank's services, JR websites affected as patching of PHP flaws underway