On Wednesday, October 21st, news came from many regions around the world early in the morning: a programming language called PHP – although unfamiliar to most, is the foundation for about 70% of websites – was found to have a vulnerability that could be exploited by hackers, prompting businesses and governments to quickly begin repairs.
The PHP vulnerability is the latest case in a series of severe software vulnerabilities recently discovered. With the increasing capability of AI, the threshold for hacker attacks continues to lower, intensifying the harm caused by such vulnerabilities. In the past, some vulnerabilities in widely used software remained undetected for a long time because they were too obscure or complex, making it difficult for human hackers to exploit them. Now, it has become much easier to identify these vulnerabilities and weaponize them.
The U.S. National Security Agency (NSA) warned that attackers could exploit these vulnerabilities to control network servers, steal data, interfere with services, or further penetrate the everyday network systems and devices used by the general public.
While in the new normal of accelerated AI attacks, the primary responsibility for security lies with software suppliers and service providers, ordinary people can still effectively reduce risks through a few methods.
Multi-factor authentication (MFA) requires confirming identity through two or more ways to log into a protected website, such as combining a password with a text verification code, authentication app, or physical security key. These methods should be used for core accounts like email, cloud storage, and social media accounts. Additionally, enabling anti-fraud protections to prevent hackers from exploiting fatigue attacks is crucial.
Emily Austin, Chief Security Researcher at network security company Censys, suggests setting unique passwords for each website and closely monitoring transaction activities. She mentioned, “When facing vulnerabilities like PHP, end users can’t do much but hope that the services they use do not adopt PHP or are actively patched.”
Dan Guido, CEO and Co-founder of network security company Trail of Bits, recommends enabling automatic updates for mobile phones, computers, and home routers (Wi-Fi devices). Companies often release patches and provide updates promptly after vulnerabilities are exposed, and installing them quickly can shorten the time hackers can exploit.
However, Guido also emphasizes that even if users do everything right, data breaches may still occur due to server vulnerabilities. “You can’t patch hospital websites yourself.”
Runa Sandvik, digital security expert and founder of Granitt, reminds people not to forget about all connected devices at home and to regularly check firmware versions. She pointed out that many IoT devices at home are rarely updated, or may not be updated at all. “These individuals should confirm with the suppliers whether there are available updates.”
In addition to system automatically updating and checking firmware versions of IoT devices, it is also crucial to disable remote management and Universal Plug and Play (UPnP) functions.
UPnP technology allows devices in the home network such as smart TVs, gaming consoles, printers, and routers to automatically discover and connect to each other. Disabling this function can prevent hackers from infiltrating multiple devices through one device.
Nic Adams, Co-founder and CEO of Orcus, a brain-machine interface company, warns that whenever significant cybersecurity threats make headlines, fraudsters and cybercriminals will seize the opportunity to profit.
He mentioned to remain vigilant about unknown network links, “When news like this surfaces, you should first open the official app or manually enter the website address to check the official statement of the affected company. Also, carefully verify any emergency messages asking to ‘immediately secure account.'”
In addition to Adams’ advice to not click on unfamiliar links in emails, text messages, or social media, one should also avoid scanning unidentified QR codes and beware of AI-generated deepfake voice, video, and image scams. If faced with urgent requests for money or verification codes, one should confirm the identity through other channels.
Paul Benda, Executive Vice President of Risk, Fraud, and Cybersecurity at the American Bankers Association, stated that since the advent of advanced AI, banks have been preparing for such moments to ensure that the bank’s money is not easily stolen.
He added that cybersecurity threats have become a “new normal,” and all consumers must remain vigilant. He recommended not reusing passwords, opting for passkeys tailored to specific websites, which are digital keys exclusive to a particular website that do not require entering passwords on the website while also resisting phishing attacks.
In addition to the methods mentioned by Benda, one can utilize biometric logins, use a password manager to generate high-strength unique passwords for different websites, switch to virtual credit cards or disposable card numbers for online purchases, regularly check for unknown transactions on bills, and implement additional two-factor verification for large transfers or account changes.
By combining these methods, individuals can effectively enhance personal protection and reduce the risk of being hacked. However, hackers are leveraging AI to analyze and breach security blind spots at unprecedented speeds. Therefore, the ultimate effectiveness of protection depends on whether software suppliers can patch vulnerabilities faster and service providers can limit the scope of damage to invaded systems.
Dr. Daniel Gardham, lecturer at the University of Surrey’s Network Security Center, indicated that in the era of AI, attackers have the advantage as the speed and ease of discovering vulnerabilities are increasing, but the speed of fixing vulnerabilities has not kept pace.
Dr. Gardham stated, “How institutions address this issue will determine whether AI makes networks more secure or more vulnerable.”