Last week, cybersecurity researchers disclosed two serious vulnerabilities in PHP, an open-source, server-side programming language used by about 70 percent of the world’s Web sites, prompting its developers to release urgent patches for the bugs, and forcing governments and companies worldwide to fix their systems immediately.
Normally, cybersecurity flaws are kept secret until a patch is ready, but the situation this time caught many people off guard as hackers launched millions of attacks to exploit the bugs within hours of them being identified. In Taiwan, the Administration for Cybersecurity was among those working hastily to patch systems.
The two critical PHP vulnerabilities, collectively dubbed PHP2Shell, involve memory management issues and allow unauthenticated attackers to execute code remotely, leading to risks such as data theft, file tampering or service disruption. They were each ranked 9.2 out of 10 in severity by cybersecurity researchers, indicating a considerable risk. Interestingly, the flaws had existed undetected in PHP for more than a decade, but were discovered by researchers using artificial intelligence (AI), media reports said.
In light of the cybersecurity threat, Web site owners should check whether their PHP-based portals are affected and, if so, apply the latest patches or go offline temporarily to reduce the risk of being hacked. About 28,000 public-facing Web sites in Taiwan are built on PHP and about 200 are government portals, data released by the Administration for Cybersecurity showed. The administration said it had received no reports of attacks on Web sites in Taiwan as of Thursday. However, experts said that cyberattacks could be hard to detect in the short term, and that Web sites might still appear normal even though they could already have been compromised.
For Web site operators who cannot complete system reviews in time or find it difficult to install security updates immediately, the window before patching could become a cybersecurity vulnerability. That is especially true for smaller organizations with limited security resources, as well as for legacy platforms running on outdated code that is incompatible with the latest PHP versions. As hackers are likely to make more attempts to exploit PHP flaws in the coming weeks, affected Web sites might be better off taking their systems offline until the vulnerabilities are patched.
However, for Taiwan’s small and medium-sized enterprises that rely on Internet portals to run their core business, quickly completing a comprehensive systems review and patching vulnerabilities is no easy task, while temporarily taking their Web sites offline means losing business. Against this backdrop, experts have encouraged firms to deploy Web application firewalls at the front end of Web sites as an alternative precaution. Such applications can act as the first line of defense to intercept malicious requests before they reach Web servers and prevent known PHP bugs such as PHP2Shell during the critical window ahead of patching.
Nonetheless, the PHP incident highlights how AI is a double-edged sword for cybersecurity. Based on media reports, researchers used frontier AI agents to discover PHP flaws that humans alone might never have found, and experts attributed the strength of AI agents to their ability to operate continuously, test thousands of pathways simultaneously and identify vulnerabilities at a speed humans struggle to match. By the same token, AI could also enable threat actors to enhance their attack capabilities. That is because advances in AI agents allow faster, more automated and more persistent attacks, while cutting the time organizations have to patch bugs. It is scary to find out that AI can uncover deeply rooted software vulnerabilities with minimal human input, but at the same time it can also scale up attacks larger and faster than ever. What is scarier is that the gap between uncovering software flaws and their exploitation is narrowing.
Moreover, reports about data breaches at companies in South Korea and Japan which link the attacks to the Chinese AI cybersecurity tool ARTEX have made global headlines and raised concerns about the misuse of AI tools. When ARTEX or other open-source, autonomous AI agents — whose parameters are publicly available for downloading and fine-tuning — fall into the wrong hands, and once their cyberattack capabilities catch up and become available to the public, it would create an irreversible risk of larger-scale misuse. While AI-assisted security tools could slowly enhance defenses and machine-speed cyberresilience would become increasingly necessary for all companies, those with weak cyberdefense capabilities would likely face greater risk of attack by misused AI agents.
High-tech manufacturing in India, backed by billions of dollars in government subsidies, has attracted cheerleaders and critics. Optimists point to Apple Inc’s decision to build an alternative supply chain to hedge against China. A quarter of all iPhones now roll out of factories near Chennai, employing tens of thousands. Skeptics counter that much of this manufacturing is mere final assembly — screwdriver work that adds little value. The fact that a much smaller economy such as Vietnam exports more merchandise shows that Indian Prime Minister Narendra Modi’s “Make in India” initiative remains more hype than reality, they said. One way to settle
Taiwan heads to the polls next month for local elections. Beneath the campaign ads lies a deeper question: What do we call this place and who gets to decide? In the pages of the Oxford English Dictionary (OED), that question has been playing out across three centuries. The entries for “Formosa” and “Taiwan” chart an island’s journey from colonial fantasy to self-named reality. Names are rarely neutral; they are the first act of possession. Nowhere is this more evident than in the OED, where the two entries serve as a linguistic seismograph for one of the world’s most enduring geopolitical fault lines.
Only 107,812 babies were born in Taiwan last year, barely half the number recorded in 2016. The nation is now a super-aged society, with more than one-fifth of its population aged 65 or older. The National Development Council forecast that the population could fall from an estimated 23.2 million this year to just 12.1 million in 2075. The decline in the working-age population would be even more severe. The number of people aged 15 to 64 is projected to plunge from an estimated 15.8 million this year to 5.1 million by 2075, a reduction of about 67 percent. By then, people
There are two space races that the democracies must win: one to deter military campaigns near Earth, and the other to secure positional deterrence on the Moon and beyond. The good news is that the US is engaged in both races, which will also benefit US allies and partners in Asia, including Taiwan. On Sept. 14, US Air Force Secretary Troy Meink disclosed, “...the US now has on-orbit space control weapons capable of defending the Joint Force against hostile adversary action.” No details about these “space control weapons” have yet been disclosed. However, a graphic apparently issued by French Space Command and posted
RSS