AI tools helped find the critical PHP vulnerabilities, and the NCSC says AI is making it easier to find and exploit software flaws at scale. For UK businesses, that points to one thing: less time to react to security updates. The best preparation is a clear picture of what you run and who looks after it, before the next alert lands.
If you read our earlier post on the critical PHP vulnerability, you’ll know the NCSC asked UK organisations to identify where PHP runs and update it. What’s worth noting now is how the flaws were found.
Wiz Research says it used AI tools to find the first of the flaws in August and reported it to the PHP security team a few days later. Fortune reports that other security teams found parts of the same issue independently, around the same time, and that all of them used AI. The fix was released on 21 October.
The flaws were reported responsibly and a fix is out, but things moved quickly after that. Within days, proof-of-concept code was public, and Rapid7 reported multiple attempts to exploit the flaws. Palo Alto Networks’ Unit 42 says it saw attackers using AI tools against a European government organisation. That’s the shift the NCSC has been warning about.
The NCSC has been warning about this since May. In a blog post, its Chief Technology Officer said AI, in the hands of skilled people, can exploit long-standing weaknesses in software at pace and at scale. The NCSC expects a “patch wave”: a rush of updates across all kinds of software, which organisations will need to apply more quickly and more often than they’re used to.
It didn’t take long for the next one. Two days after the fixes, PHP disclosed another issue. It only affects applications with an unusual set-up, and PHP plans to fix it in its next routine release. The temporary workaround is the same one it recommended on 21 October, so anyone who applied it is already covered.
That’s the NCSC’s forecast, not a certainty. But it advises organisations of every size to prepare, which is reason enough to get the basics in place.
An alert is only useful if you can match it to something you own. Without a list, every alert starts with a hunt, and the hunt is where the time goes.
“What you run” is wider than most people think. It helps to split it into three groups:
You don’t need special tools to get a first draft. Try:
For each item, note what it does, whether it faces the internet, who looks after it, how it gets updated, when support ends, and who to contact about security updates. That last one saves a lot of time when an alert lands.
Start with anything internet-facing and don’t wait for a perfect list. The aim is a list that’s roughly right and kept up to date. Review it whenever you buy, change or retire something, and give one person ownership of it. A list that’s a year old is only a little better than none.
None of this needs specialist skills to start:
If you want to see how this plays out for a specific alert, the PHP checks are in our earlier post.
Did AI find the PHP vulnerabilities?
AI tools helped. Wiz Research says it used them to find the flaws, and Fortune reports that other security teams, also using AI, found parts of the same issue independently.
Are the PHP vulnerabilities being exploited?
Proof-of-concept code is public, and Rapid7 has reported multiple attempts to exploit the flaws. Palo Alto Networks’ Unit 42 says it saw attackers using AI tools against a European government organisation. If you run PHP and haven’t updated, treat it as urgent.
Has there been another PHP vulnerability since?
Yes. Two days after the fixes, PHP disclosed another issue that only affects applications with an unusual set-up. PHP plans to fix it in its next routine release, and the temporary workaround is the same one it recommended on 21 October.
What is the NCSC’s “patch wave”?
It’s the NCSC’s term for an expected rush of software updates as more vulnerabilities are found and disclosed, partly because AI makes finding them easier. The NCSC advises all organisations to prepare to patch quickly, more often and at scale.
How do I find out what my business runs?
Start with your domain records, hosting and cloud accounts, supplier contracts and software subscriptions, and your IT provider’s records. For each system, note what it does, whether it faces the internet, who looks after it, how it gets updated and when support ends. Start with anything internet-facing.
Do small businesses need to worry about the patch wave?
The NCSC advises organisations of every size to prepare, not just large ones. A simple list of what you run, automatic updates where you can, and a clear plan for who acts on a critical alert are a sensible place to start.