PHP cyber glitch: Former Obama cyber chief explains why AI finding software flaws is 'tech debt coming due'

Former White House cybersecurity coordinator under US President Barack Obama said the PHP episode marked the beginning of a "pretty chaotic period".

The sudden rush by global companies and government agencies to patch two critical flaws in PHP -- the programming language powering a vast majority of the internet -- highlighted a pivotal shift in modern cybersecurity.

The vulnerabilities, uncovered using a powerful OpenAI model, were among the most high-profile demonstrations to date of artificial intelligence's capabilities in the cyber domain.

However, according to Michael Daniel, president of the Cyber Threat Alliance and former White House cybersecurity coordinator under US President Barack Obama, this episode marked the beginning of a "pretty chaotic period".

In an interview with AFP, Daniel explained that advanced AI models that find software vulnerabilities at high speed and on massive scales will inevitably lead to a flood of similar discoveries.

Calling this a "great cleansing forest fire" of old software, Daniel noted that the technology industry's "tech debt" is finally coming due.

"The incentives have been for people to keep software as long as possible, and we don't really factor these risks into the cost of having the software," he told AFP.

Daniel warned that while companies do not incur direct costs on their books for maintaining old software, the implicit costs become devastatingly apparent when vulnerabilities like the PHP glitch are exposed.

Shrinking window for defence

The sheer speed at which malicious actors can now operate changes the fundamental calculus for corporate IT departments. While Daniel noted that the historical exploitation rate for vulnerabilities has hovered around five or six per cent -- a figure he does not expect to rise -- the timeline for weaponising these flaws has drastically accelerated.

"It used to take a month or two for a proof of concept to come out, and then another month or two for it to show up in exploit kits," Daniel told AFP. "That's now measured in hours or days."

This accelerated threat landscape forces large companies to abandon their traditional, cautious approach to software updates.

Businesses that previously operated with a zero-risk tolerance -- heavily testing patches to ensure they wouldn't break existing systems -- no longer have that luxury.

Daniel pointed out the new trade-off: organisations must now weigh the minor risk of a patch temporarily breaking a system against the potential multi-million-dollar disaster of a cyberattack.

Consequently, Daniel advised that both large and small organisations must shift their operational structures to accept and implement vendor updates as rapidly as possible to survive the impending flood of vulnerability disclosures.

He told AFP that many AI-flagged vulnerabilities are either false positives or exist on software that is never exposed to the internet, underscoring an urgent need for the industry to improve its triage systems.

Looking ahead, Daniel anticipated a shift toward proactive defence. Within the next two to three years, he expects developers to enable these AI tools in software before they are ever deployed to the public.

"You burn out all the old stuff, and it makes way for new growth that's more secure from the beginning," Daniel explained to AFP.

He concluded that while AI will not entirely solve the global cybersecurity problem, it will permanently change the nature of the industry moving forward.