Commentary: PHP vulnerabilities – why the good guys have notched a victory in AI-cybersecurity age

Now that the exploit has been made public, hackers will be identifying those weak spots, too, and some have already done so. 

Dane Knecht, chief technology officer at Cloudflare, said the company had, before the patch was made available, seen “early attacks emerging” against its clients and was offering them stopgap measures until the weakness had been patched. These attacks are nothing compared with what might have happened had these vulnerabilities been discovered by bad actors first.

The incident underscores the growing importance of specialised cybersecurity firms in the AI age. It was only in February that the stocks of leading security companies like Cloudflare and Crowdstrike took a bath over investor fears that AI lab Anthropic was going to steal their business. 

What nonsense that seems today, with the opposite proving true.

The new paradigm of security threats has made cybersecurity expertise more valuable, so it’s no surprise that Cloudflare shares rose around 7 per cent on the news, up 76 per cent since that February shock. Crowdstrike is up 146 per cent in that time.

Of course, the AI firms are helping defend against a risk they helped create, but that cat’s out of the bag now – the same technology that can discover new drugs or write complex code can be used to hack computers. The only course of action is to deal with it. 

This incident should provide encouragement. The takeaway is that a collaboration between security researchers and frontier AI labs gave the world a head start against a serious threat. These collaborative efforts must continue and be expanded.

We’re not out of the woods yet. As ever in cybersecurity, the onus is still on security teams to act.

But these teams do so in full possession of the facts, with a patch ready to go, and in a state of relative calm thanks to trusted sources offering well-considered remedies. The fact that none of this made it to the front pages or nightly news bulletins counts as a battle won in what will be a never-ending war.