Security flaws in widely used software are piling up, and attackers currently seem to have the upper hand. According to heise online, an expert from the German Federal Government's Cyber Agency (Cyberagentur des Bundes) explains why vulnerabilities like the one in PHP are on the rise at the moment. He also describes how artificial intelligence (AI) could help in the future.

Why the situation is difficult for defenders

A security flaw is an error in code that attackers can exploit, for example to steal data or take over systems. PHP is a programming language that runs on many web servers. When a vulnerability becomes known there, it can affect a great many operators at the same time.

In principle, the balance of power is uneven. Attackers only have to find a single vulnerability. Defenders, by contrast, have to know about all the gaps in their systems, or as many as possible, and close them. The larger and more interconnected software becomes, the more attack surface it creates. This helps explain why the expert describes the situation with the image of a "valley of tears".

What hopes are placed on AI

According to the report, AI could strengthen the defenders' side in the future. It is conceivable that such tools could detect errors in code earlier, before software is released. They could also save time when analyzing large volumes of warning messages. It remains unclear how quickly and to what extent this will succeed. The same techniques could also benefit attackers.

What readers can do

No checklist can be derived from the report, but a few basic rules still apply:

  • Update software and server components such as PHP regularly, and follow the manufacturers' security notices.
  • Check which programs and versions are actually running in your own environment. You can only secure what you know about.
  • Switch off unneeded features and extensions to reduce the attack surface.
  • Create backups and test restoring them, in case an attack succeeds after all.

Anyone who runs web applications should therefore plan updates as a fixed routine. The expert's full statements can be found in the original article on heise online.