The UK is facing a greater threat “than we have, certainly for most, if not all, of my lifetime”, Wes Streeting told the BBC.
The defence secretary was referring to the vulnerabilities discovered in PHP, a programming language used in up to 70% of websites. Since then “millions of attacks” have been launched in attempts to exploit the flaw, said The Times, and a “patch” has been rolled out to help sites deal with the issue. The government announced 32 of its services were offline, though there is no indication of a breach.
For many, this episode has highlighted the dependence on, and vulnerability of, internet use. With AI growing ever more powerful – and likely being used by hackers as well as those researchers who found the PHP vulnerabilities – this could be just the beginning of an era of disruption.
What did the commentators say?
In the last few days, the internet has been “tested in a way I have not seen in my – or its – lifetime”, said Andrew Griffin in The Independent. Usually global catastrophes “capture our attention and excite our energy”, whereas the “gradual weakening of things we depend on engenders boredom”. But we need to be aware that AI does threaten the world, just not in a traditional way. It does so in a “way so dull and disengaging that we don’t even realise”.
“The future is here” and our digital infrastructure is “looking very fragile”, said Chris Stokel-Walker in The Guardian. “The solution is the same one we keep talking about, but rarely actually do anything about.” Large tech companies, who make “billions” from software they are obtaining for free from open-source data, “should contribute properly to maintaining it”. Unless we start “properly valuing those who keep our internet safe”, the internet will break, again.
There have been warnings of this crisis for the “better part of a year”, said Matteo Wong in The Atlantic. In the last few weeks, there have been major cyberattacks on “governments, data centres, and hospitals in Ukraine, Russia, Argentina, Bangladesh and Indonesia”.
“Bulking up” IT departments and using passkeys and two-factor authentications are still “important”, but the “most urgent and practical advice being given now is to retreat: prepare to simply go offline”. There is little time now to prepare for the “deluge” of AI-based hacking. In fact, “the dam may have already broken”.
The PHP “patch” does not spell the end of these “dramatic” issues, said an editorial in The Times. “Millions” of websites will still need to be updated, despite the fix, and even then, hackers could use the opportunity to “illuminate their route into systems that may still be sitting unprotected”.
Government preparedness should be an absolute “political priority”. Pilot projects on cyber defence and the AI Safety Institute represent “sensible” first steps, but “more must be done” in the form of public awareness and creating “decisive state emergency levers” in times of crisis. We should not panic, but the coming weeks will “no doubt reveal continuing threats, especially to smaller bodies with less stringent security”.
What next?
“There’s a race on” between attackers and the tech companies who are rolling out the “patch”, said Rowland Manthorpe on Sky News. “The trouble is, this patch doesn’t cover all PHP sites.” Based on data gathered from around 2.6 million services, about 75% don’t run newer versions of PHP, and so it will be “much harder” for them to implement the fixes.
In the long term, AI “could be amazing” for developing cyber defences, but for now it seems the “attackers might have the advantage”. So “we could be in for a bumpy few years”.