It was supposed to be kept quiet until everyone had a chance to fix their sites – but the news was leaked.
From that point the clock started ticking.
As I write this, there are no reports that anyone or anything has succeeded in using the flaws to attack a site.
“There’s a real dilemma,” said Prof Alan Woodward from Surrey University.
“How do you alert people they need to be ready, and then that a patch is urgently required, whilst not alerting attackers?
“Basically you’re telling everyone about the problem at the same time and hoping the defenders aren’t awake enough to act as soon as the patch is out.”
But we do know from large web companies like Cloudflare and Palo Alto Networks that millions of attempts have been made.
We probably won’t know for a while whether it has worked for any criminals, because the companies affected might not be aware yet either.
As far as we know the unexploded bomb remains intact for now, and for some experts this is a success.
Gina Neff, Professor of Responsible AI at Queen Mary University, described this as a good news story.
“We’ve seen how a team of people supported by the large AI company have used AI to find the problem, work for months together to solve it and get everybody ready to be safe and security,” she told the Today Programme on BBC Radio 4.
“We have enormous capability to handle these risks.”
But the baddies can use AI too, and those same tools are probably churning away right now trying to get in.
Cyber security authorities are warning website owners to fix the weaknesses immediately, but the patch only works on the latest version of PHP, so older sites will need to upgrade first.
For many it may be a significant repair job, so if there’s a web developer in your life you may want to send them thoughts, prayers and maybe a strong coffee.
About The Author
