Government websites go dark after AI-discovered flaw sparks security scramble - The Japan Times

The PHP developers have done the decent thing and shipped urgent fixes for vulnerabilities that, do keep up, were uncovered using AI. All users are "encouraged to update immediately," which is the security equivalent of a smoke alarm that says you may wish to consider leaving the building. Encouraged. Not instructed, not compelled — merely encouraged, as though the attackers reading the same changelog might observe a gentleman's agreement about pacing.

Meanwhile government agencies across Europe have taken their websites offline as a precaution, which is the digital equivalent of bricking up the front door because the locksmith found a fault in every lock ever made. Tech firms warn that some hackers are already exploiting the flaws. Of course they are. There is no courtesy window, no polite interval between the disclosure and the ram-raiding; the AI that found the bugs did not come with a licence agreement specifying who gets to look first, and the people who wrote the patch are volunteers while the people probing it are on salaries.

We have been here before: the Cairn business we covered a fortnight ago was the same story in a different hat — a platform built to be freely available turning out to be freely available to people with worse intentions than the pitch deck assumed. Now the tooling finds the holes faster than the humans fill them, and the filling is done by an open-source project's mailing list while the emptying is done by professionals with a business model. The internet runs on PHP, which means the internet has once again been asked to update immediately and carry on. Somewhere a policy person is drafting a framework about all this, and the framework will be ready some time after the last unpatched server has been thoroughly enjoyed by someone else.