Advanced AI systems are rapidly transforming the ongoing cat-and-mouse game that cybersecurity specialists have been playing with shadowy opponents for years. The latest skirmish is a dramatic opening scene for a high-stakes thriller coming to your screens, whether you like it or not.
This story starts, as it should, with the scary parts.
Two days ago, elite computer security experts announced the discovery of a critical vulnerability hiding in plain sight—one embedded in PHP, the software that powers an estimated 70% of the world’s websites. This bug allows bad actors to execute programs on the target machines, which is to say, take them over and do with your data as they please. The discovery instantly set off a mad scramble to patch the problem (just getting underway), as well as a nefarious effort by bad actors to exploit the bug for fun and profit before it gets fixed.
Persuasion is a registered nonprofit that relies on reader support to pay our staff and keep our content free for everyone. If you value our work and want to fight for liberal values wherever they are threatened, please become a paying subscriber today!
Key to the plot are firms with suitably obscure names—Wiz and Calif. Both firms are straight out of central casting. Wiz is a giant Google-owned company founded by Israeli military intelligence veterans to help major companies secure their computer systems; Calif is an elite boutique cybersecurity firm that employs an international cadre of hackers and is deeply integrated with the top AI labs to help them test their products for vulnerabilities.
Wiz and Calif were using different advanced AI tools to run tests on PHP when they each independently discovered a flaw that had been lurking in the software for more than a decade. While the bug itself had been spotted as far back as 2020, researchers had mistakenly thought that it could only cause a software crash. But the plot twist was that the AI tools were able to show it could be weaponized to take over the entire machine, making the threat widespread and urgent—something that they estimated would have taken a team of human experts months to discover on their own, if ever.
The fallout of this discovery is now unfolding. Companies that monitor systems for cyber-intrusions, such as Cloudflare, soon detected millions of attempts to weaponize the flaw. In the UK alone, 32 government services were immediately taken offline out of caution until they could fix the problem. Many more organizations and governments around the world have since followed suit.
So what’s really going on, and what does this say about the risks of the new wave of large-scale generative AI?