AI helps find vulnerability affecting up to 70% of websites
For the ciso of a regional us bank
France, Denmark, Finland and the Netherlands took government websites offline on Wednesday after web developers used AI to identify a bug affecting up to 70% of the world's websites, Semafor reported on Oct. 21.1
The sources do not name the affected software or say why the four governments chose to take sites offline, though fixes have been newly released.1 A cybersecurity researcher told Reuters that AI will enable hackers to reverse engineer the bug in a "race to exploit" the public fix, according to Semafor's summary.1
The co-founder of Google's Wiz cybersecurity team told The Wall Street Journal the exploit is "the most severe AI vulnerability … ever found," and said humans probably could not have discovered it without AI, per Semafor.1
Japan's prime minister urged "everyone to take action tonight" to apply the newly released fixes, according to Semafor.1
The researcher told Reuters the next step would be the "mass compromise of every vulnerable web server on the internet." This is a prediction by that researcher, not a confirmed event.1
Semafor's item does not name the software, the vendors, the researcher or the developers who found the flaw, and it gives no figures on exploitation so far.1
Patching may not be enough on its own, because a public fix can show attackers what changed. Banks and fintechs need to work out which of their web servers and vendor-hosted systems are exposed, since the item does not name the software, and press vendors on their patch timing.
Our take. Four European governments pulled their own websites offline rather than wait. The fix that protects your servers is also the attacker's map to them, so the patch clock started when it was published, not when your change board meets.
Action. Vulnerability management: Inventory internet-facing and vendor-hosted web servers, apply the newly released fixes, and get written patch confirmation from critical vendors.