PHP cyber glitch: Former Obama cyber chief explains why AI finding software flaws is ‘tech debt coming due’

The sudden rush by global companies and government agencies to patch two critical flaws in PHP—the programming language powering a vast majority of the internet—highlighted a pivotal shift in modern cybersecurity.

The vulnerabilities, uncovered using a powerful OpenAI model, were among the most high-profile demonstrations to date of artificial intelligence's capabilities in the cyber domain.

However, according to Michael Daniel, president of the Cyber Threat Alliance and former White House cybersecurity coordinator under US President Barack Obama, this episode marked the beginning of a “pretty chaotic period”.

In an interview with AFP, Daniel explained that advanced AI models that find software vulnerabilities at high speed and on massive scales will inevitably lead to a flood of similar discoveries.

Calling this a “great cleansing forest fire” of old software, Daniel noted that the technology industry's “tech debt” is finally coming due.

“The incentives have been for people to keep software as long as possible, and we don't really factor these risks into the cost of having the software,” he told AFP.

Daniel warned that while companies do not incur direct costs on their books for maintaining old software, the implicit costs become devastatingly apparent when vulnerabilities like the PHP glitch are exposed.

Shrinking window for defence

The sheer speed at which malicious actors can now operate changes the fundamental calculus for corporate IT departments. While Daniel noted that the historical exploitation rate for vulnerabilities has hovered around five or six per cent—a figure he does not expect to rise—the timeline for weaponising these flaws has drastically accelerated.

“It used to take a month or two for a proof of concept to come out, and then another month or two for it to show up in exploit kits,” Daniel told AFP. “That's now measured in hours or days.”

Navigating AI ‘noise’ and future security

(With AFP inputs)

Arshdeep Kaur