Hackers are moving faster with AI. Can your cybersecurity keep up?

On 21 October, governments, businesses and public organisations around the world began temporarily taking websites and online services offline following warnings about two critical vulnerabilities in PHP, a programming language used by a significant proportion of the world’s websites.

What began as a security issue affecting widely used website technology quickly became an international race to protect vulnerable systems, with millions of attempted attacks being detected as organisations worked to apply urgent security updates.

The incident also highlighted the growing influence of artificial intelligence in cybersecurity and raised important questions about whether businesses are adequately prepared to detect and respond to threats as they emerge.

PHP is a programming language that helps power websites and online applications used by organisations of all sizes.

Security researchers discovered two critical vulnerabilities that could potentially allow attackers to gain unauthorised control of vulnerable web servers, access sensitive information or disrupt online services.

The researchers had been working with PHP developers to address the weaknesses before making the details public. However, information about the vulnerabilities was leaked before the planned announcement, giving cybercriminals an opportunity to begin targeting potentially affected websites before organisations had completed their security updates.

The consequences were felt around the world.

Government websites and public services were temporarily taken offline in countries including the UK, Germany, France, the Netherlands and Finland. Organisations in Japan and elsewhere also restricted access to online services while they assessed their exposure and applied the necessary fixes.

In the UK, 32 government services were reported to have been taken offline as a precaution, while the National Cyber Security Centre issued 50,000 alerts to potentially affected organisations.

According to cybersecurity company Cloudflare, tens of thousands of attempts to exploit the vulnerabilities were recorded within 45 minutes of the public announcement. This increased to hundreds of thousands within two hours, with millions of attempted exploits recorded by the following day.

Although these figures do not mean millions of websites were successfully compromised, they demonstrate the speed at which attackers can begin targeting newly disclosed vulnerabilities.

As reported in The Guardian’s coverage of the worldwide incident, organisations were racing to secure vulnerable systems while attackers attempted to take advantage of the situation.

One of the most significant aspects of this incident was the role artificial intelligence played in identifying the vulnerabilities.

Security researchers used advanced AI technology to help discover and investigate weaknesses that had existed within PHP for years. This demonstrates how AI can help cybersecurity professionals identify risks that might otherwise remain undiscovered. However, the same AI technology also presents opportunities for cybercriminals.

Reports following the disclosure described attackers experimenting with exploitation techniques developed with AI assistance. AI tools can make it easier to analyse software, investigate weaknesses and develop potential methods of attack, significantly reducing the time available for businesses to respond when a new vulnerability becomes public.

The PHP incident clearly illustrated this particular challenge. Once details of the vulnerabilities were leaked, attempts to exploit them began rapidly, creating considerable pressure on organisations to identify affected systems and implement security measures.

For business owners, the concern is not simply about whether their systems contain vulnerabilities, but whether they have the right measures in place to identify emerging threats and respond quickly enough to reduce the potential impact.

Most businesses already recognise the importance of cybersecurity measures such as antivirus software, firewalls, security updates and access controls. While these measures remain essential for protecting business systems and information, no preventative measure can guarantee that every potential threat will be stopped.

Previously unknown vulnerabilities can be discovered, employees can fall victim to increasingly convincing phishing attacks, and legitimate business accounts can become compromised without immediately raising an obvious warning.

Today, effective cybersecurity should combine three key capabilities: prevention, detection, and response.

Prevention focuses on reducing the opportunities for attackers to access your systems, using security controls that block unauthorised activity wherever possible.

Detection involves actively monitoring systems and identifying unusual activity that could indicate unauthorised access to the network.

Response refers to the immediate actions taken when a genuine threat is identified to contain it and minimise disruption.

Together, these capabilities provide a more complete approach to cybersecurity than reliance on preventative measures alone.

For many business owners, cybersecurity is something they understandably expect their IT provider or internal IT team to manage.

However, having security software installed does not necessarily mean that your systems are being actively monitored for suspicious activity.

For example, if a cybercriminal attempted to access your Microsoft 365 accounts using stolen credentials, would anyone notice? If suspicious activity occurred overnight or at the weekend, would it be noticed and investigated? And if an account or device was compromised, would someone be available to take appropriate action?

Early detection and rapid response can make a significant difference to the impact of a cybersecurity incident.

The PHP incident also demonstrated the importance of understanding who is responsible for protecting the different areas of your technology. Website security, for example, may be managed by a hosting provider or web developer rather than your usual IT Support company.

It’s important to know who is responsible for website management, security updates, and taking action when a threat is identified.

At Curveball, we believe businesses should be able to operate with confidence, knowing their cybersecurity is actively managed and that the right expertise is available when threats emerge.

This is why we have introduced Cyber Confidence, our advanced cybersecurity solution designed to help businesses strengthen their defences against the latest cyber threats.

Cyber Confidence combines three essential areas of modern cybersecurity.

 1. Prevention: Advanced Zero Trust security helps stop unauthorised applications and activity, reducing opportunities for attackers to compromise business systems.

 2. Detection: AI-driven threat detection and continuous security monitoring help identify suspicious activity across your business environment, including Microsoft 365.

 3. Rapid Response: Experienced cybersecurity specialists are available 24/7 365 to investigate identified threats and take action to contain incidents quickly.

By combining advanced security technology, continuous monitoring, and expert response, Cyber Confidence helps businesses improve security without needing to maintain a dedicated cybersecurity team. It also complements essential security practices such as software updates, vulnerability management and reliable backups, providing additional visibility and protection across the systems it covers.

The worldwide PHP incident is a reminder that even established and widely used technology can contain serious security weaknesses, and that organisations may have very little time to react once those weaknesses become known.

As artificial intelligence continues to develop, it is likely to play an increasingly important role in discovering vulnerabilities, as well as helping attackers exploit them.

Businesses cannot realistically eliminate every cybersecurity risk, but they can take practical steps to reduce their exposure, identify suspicious activity and respond effectively when something goes wrong.

Ultimately, confidence in your cybersecurity should come from knowing that your business has the protection, monitoring and expertise needed to deal with the latest threats.

Find out more about Cyber Confidence and how it can help protect your business.

If we’ve provided you with a dark web report, we’re happy to talk you through it.

We can explain what has been found, what it could mean for your organisation and whether there any immediate actions we would recommend.

You don’t need to be a cybersecurity expert and you don’t need to arrive with all the answers. The purpose of the conversation is simply to help you understand the findings and decide whether anything else needs investigating. From there, there are several possible next steps.

If you’re not sure how well protected your organisation currently is, our Cybersecurity Assessment is a useful place to start. It helps you take a broader look at your cybersecurity rather than concentrating on one exposed password or email address.

The aim is to identify areas where you are already well protected, as well as possible security gaps that could warrant attention.

That gives us something much more useful to discuss. Instead of just

‘Have our details appeared on the dark web?’ but ‘How much confidence do our current security measures give us?’