The Importance of Timely Cybersecurity Alerts

Many people might not be aware of recent vulnerabilities affecting major web infrastructures. However, students in cybersecurity classes are discussing these developments extensively. Recent attention has been focused on PHP2Shell, two security flaws in the PHP programming language, which is used by about 70% of websites.

The vulnerabilities were hidden in the language since at least 2012. They were discovered by a researcher with an OpenAI model. PHP’s maintainers issued a patch on October 21, but by then, attacks had already started. Patches only guard the servers where they are installed. AI can now determine from a patch what vulnerability it fixes and how to exploit it. In previous times, this would have required the skills of intelligence services or elite hacking groups. Currently, defenses are lagging behind.

Qualys identified 167 million PHP installations on its clients’ systems. A mere twelve hours after disclosure, only about one in a thousand had been updated. This update gap can last for weeks. On October 27, Anthropic announced that its Claude model created an exploit capable of controlling certain Linux servers due to a vulnerability in how they manage network connections. Linux developers repaired this issue on October 5, but Ubuntu, a leading Linux version for servers, had not released the fix as of November 2.

Unpatched vulnerabilities often trigger destructive attacks. For example, in March 2017, the Apache Software Foundation addressed a vulnerability in Struts. This software is widely used by companies for website development. Two months later, attackers exploited it to breach Equifax, which hadn’t applied the patch, leading to the theft of personal data from 147 million Americans.

Utilizing Media Cloud, an open archive of online news, an analysis was conducted to measure national media coverage on 25 significant cyber events and the Struts patch during the eight days following their public announcement. No national media published stories on the patch, although the Equifax breach stories averaged 16 out of every 1,000 published.

The pattern continues. Media Cloud’s October index of major news outlets shows limited coverage. Following the public disclosure of PHP2Shell on October 20, outlets like CNN, Fox News, NPR, and USA Today released 5,610 stories. Merely nine made mention of PHP2Shell or other vulnerabilities from that week, and only two included them in headlines.

While not all vulnerabilities warrant headlines, given that a record 5,461 vulnerabilities were published the week of October 12 alone, some vulnerabilities can impact nearly everyone. Significant cyber events flagged by the Storm Center from 2010 to 2021 frequently saw no coverage in national media.

Growing capabilities of AI systems are driving an increase in vulnerability discoveries. Over time, identifying and fixing vulnerabilities will improve safety. However, the immediate surge creates numerous unpatched targets for attackers. The public needs alerts similar to hurricane watches.

The National Weather Service offers warnings in plain language. CISA, the Cybersecurity and Infrastructure Security Agency, should also provide public alerts for critical vulnerabilities in widely used software and subsequent attacks. News outlets already cover recalls for cars and food, so they should also report on cybersecurity warnings.

The new Congress will determine the direction of AI development, funding for alert agencies, and responsibility for unpatched server exposures. Even AI enterprises are warning of increasing challenges. Jason Clinton from Anthropic advised security leaders to seek board assistance proactively.

While AI redefines the threat landscape weekly, the responsibility for responses remains with human intelligence, including lawmakers and corporate boards. They must be informed about risks. Equifax had two months to apply a patch. PHP2Shell’s targets faced attacks before any patch was available. We don’t wait for a storm surge to announce a hurricane. Similarly, we must alert the public prior to breaches.

The opinions in Fortune.com commentary pieces reflect only the author’s views and not those of Fortune.