Using AI in Cyber Security

Many websites acroos the world were taken down due to a flaw in the then current (Oct 2926) PHP core flaw. This had the potential of affecting 70% of the sites currently on the World-Wide-Web.

In the UK 32 government websites were temporily suspended until the flaw was patched.
Whether this was actually necassary we will never know. No reports of sites being compromised were reported, but many of the less popular, and you could say less important, are run by those who are not aware of what PHP is and if their site has any connection to its use.

The Guardian reported that millions of attempts were made to exploit this flaw. I am not sure where they get this figure as there just as many attempts looking for code flaws made every day. Even this website sees quite a few per day. Entries in my server logs sees many accesses from those looking for specific files that may exist on my server.

The use of Artificial Intellience could be significant in the analysis of these attacks.

Server logs can be used to determine what attacks have occured and where they originated. Accesses to pages/resources on a website that could be vulnerable to attack can be collated with a possible determination of where these attacks were coming from.

Probing for PHP files

The attack vector has a familiar format. The first thing an agent who wants to gain access to your system is to determine what platform you are using. The most popular probe seems to be those looking for PHP files.

An irony here is that just because a particular file can be found on your server this does not necassarily indicate to the rogue agent that you are running a platform that uses PHP. Such a platform is Wordpress and many of the probes are for PHP files that relate to Wordpress. These could include files that contain administration utilities. However, these files may well be located on your webserver but you are not using them. In my case the probes for such files result in the "file not found" response, a "404".

Another irony is that PHP is included on most Linux server installations as they form the basis on what a LAMP server is.

RCE and RPC

The PHP flaw that was revealed in October 2026 is described as an OOM (Out of Memory) situation that could give rise to an RCE (Remote Code Execution) by a rogue agent. An earlier flaw with a PHP routine/program used by Wordpress (xmlprc.php) was cited as allowing RPCs (Remote Proceedure Calls) to be made if the module was exploited. The mitigating measure for this flaw was a recommendation that xmlrpc.php be disabled or removed from the installation as it should not be used by current versions of Wordpress.

In this more general case no actions that are not intended should be allowed to be initiated remotly. The execution of such code can give rise to a multitude of threats such as code injection, the stealing of user data and other damage to the website.

While RCE and RPC are different terms and relate to specific aspects of system operation they both are situations that can lead to a compromised state.