AI is finding security flaws faster: do you know what you run?

AI tools helped find the critical PHP vulnerabilities, and the NCSC says AI is making it easier to find and exploit software flaws at scale. For UK businesses, that points to one thing: less time to react to security updates. The best preparation is a clear picture of what you run and who looks after it, before the next alert lands.

How AI found the PHP flaws 

If you read our earlier post on the critical PHP vulnerability, you’ll know the NCSC asked UK organisations to identify where PHP runs and update it. What’s worth noting now is how the flaws were found.

Wiz Research says it used AI tools to find the first of the flaws in August and reported it to the PHP security team a few days later. Fortune reports that other security teams found parts of the same issue independently, around the same time, and that all of them used AI. The fix was released on 21 October.

The flaws were reported responsibly and a fix is out, but things moved quickly after that. Within days, proof-of-concept code was public, and Rapid7 reported multiple attempts to exploit the flaws. Palo Alto Networks’ Unit 42 says it saw attackers using AI tools against a European government organisation. That’s the shift the NCSC has been warning about.

What the NCSC expects next

The NCSC has been warning about this since May. In a blog post, its Chief Technology Officer said AI, in the hands of skilled people, can exploit long-standing weaknesses in software at pace and at scale. The NCSC expects a “patch wave”: a rush of updates across all kinds of software, which organisations will need to apply more quickly and more often than they’re used to.

It didn’t take long for the next one. Two days after the fixes, PHP disclosed another issue. It only affects applications with an unusual set-up, and PHP plans to fix it in its next routine release. The temporary workaround is the same one it recommended on 21 October, so anyone who applied it is already covered.

That’s the NCSC’s forecast, not a certainty. But it advises organisations of every size to prepare, which is reason enough to get the basics in place.

Do you know what you run?

An alert is only useful if you can match it to something you own. Without a list, every alert starts with a hunt, and the hunt is where the time goes.

“What you run” is wider than most people think. It helps to split it into three groups:

  • Things you own and manage: servers, laptops, network equipment and any systems kept on-site.
  • Things other people run for you: your website, hosted applications, cloud services and anything a supplier manages on your behalf. These are the easiest to forget, because nobody in the business ever logs in to update them.
  • Things hidden inside other things: software and appliances often include other components. The NCSC’s PHP alert says appliances and services may bundle PHP, so the product on your list may not tell you everything that’s inside it.

Where to look when building the list

You don’t need special tools to get a first draft. Try:

  • Your domain registrar and DNS records. Every address you own points at something, so this quickly shows what’s online.
  • Your hosting and cloud accounts.
  • Supplier contracts, invoices and software subscriptions.
  • Your IT provider’s records, if you have one.
  • Company card and expense records, which often show software that someone bought without telling IT.

What to record

For each item, note what it does, whether it faces the internet, who looks after it, how it gets updated, when support ends, and who to contact about security updates. That last one saves a lot of time when an alert lands.

Keeping it useful

Start with anything internet-facing and don’t wait for a perfect list. The aim is a list that’s roughly right and kept up to date. Review it whenever you buy, change or retire something, and give one person ownership of it. A list that’s a year old is only a little better than none.

Getting ready before the next alert

None of this needs specialist skills to start:

  • Build and maintain your list of what you run, as above.
  • Turn on automatic updates wherever you safely can. The NCSC recommends this, and it takes a lot of manual work out of the process.
  • Replace or isolate anything that no longer gets updates. Systems that have reached end of life can’t be patched, so they become the weak points.
  • Agree your response in advance. Decide how quickly you’ll act on a critical alert and who makes the call. Even a one-line rule, like “internet-facing systems first, within days”, beats working it out under pressure.
  • Use Cyber Essentials as a baseline. The NCSC points to it as a way to raise your general resilience.

If you want to see how this plays out for a specific alert, the PHP checks are in our earlier post.

 

Cyber Posture Assessment Booking Link

Frequently asked questions

Did AI find the PHP vulnerabilities?
AI tools helped. Wiz Research says it used them to find the flaws, and Fortune reports that other security teams, also using AI, found parts of the same issue independently.

Are the PHP vulnerabilities being exploited?
Proof-of-concept code is public, and Rapid7 has reported multiple attempts to exploit the flaws. Palo Alto Networks’ Unit 42 says it saw attackers using AI tools against a European government organisation. If you run PHP and haven’t updated, treat it as urgent.

Has there been another PHP vulnerability since?
Yes. Two days after the fixes, PHP disclosed another issue that only affects applications with an unusual set-up. PHP plans to fix it in its next routine release, and the temporary workaround is the same one it recommended on 21 October.

What is the NCSC’s “patch wave”?
It’s the NCSC’s term for an expected rush of software updates as more vulnerabilities are found and disclosed, partly because AI makes finding them easier. The NCSC advises all organisations to prepare to patch quickly, more often and at scale.

How do I find out what my business runs?
Start with your domain records, hosting and cloud accounts, supplier contracts and software subscriptions, and your IT provider’s records. For each system, note what it does, whether it faces the internet, who looks after it, how it gets updated and when support ends. Start with anything internet-facing.

Do small businesses need to worry about the patch wave?
The NCSC advises organisations of every size to prepare, not just large ones. A simple list of what you run, automatic updates where you can, and a clear plan for who acts on a critical alert are a sensible place to start.

Useful links