IT-Sicherheit: Experte: Software-Schwachstellen bleiben länger ein Problem

A leading IT-security expert has warned that software vulnerabilities, like the widely-recognized PHP flaw, are likely to persist for longer than previously thought. Daniel Gille, head of Key Technologies at the German Federal Cyber Agency, stated that while a plateau may eventually be reached as software cannot have infinite weaknesses, attackers currently have a significant advantage.

They can rapidly assess and exploit a published vulnerability within minutes or hours, a stark contrast to the weeks or months it once took. This is evident in the recent PHP vulnerability, where many operators took hours or more than a day to restore their websites after applying updates. The Federal Office for Information Security has classified the risk of this vulnerability as exceptionally high, and authorities have yet to report successful attacks on government systems; the Digital Ministry is investigating whether data may have been compromised.

IBM's X-Force security team observed a dramatic surge in newly disclosed vulnerabilities across major software providers like Microsoft, Oracle, and the Chrome browser, with over 10,124 vulnerabilities identified between January and September this year, representing a roughly 578 percent increase compared to the same period last year.

Half of these vulnerabilities were deemed high or critical according to a risk scoring system commonly used in the industry. The German Cyber Agency is planning a research program to explore how AI could help write code that is less susceptible to attacks. They also consider the possibility of using AI as the foundation for an operating system, an idea that is still controversial among experts but could potentially result in a fundamentally different architecture without a fixed codebase.