Nikesh: Major cybersecurity vulnerabilities will become more common

Podcast guest Nikesh called the recent PHP vulnerability serious and compared its scale to Log4j, saying it affects a large share of the internet that uses PHP. He noted that heads of state had discussed it and that the NSA had issued a notice. The industry had long expected more vulnerabilities to be discovered, he said; he expects to see more of them over the next 6–12 months.

Nikesh said his company scanned infrastructure and found 22 million locations where the vulnerability persisted; after further filtering, the estimate was about 9–10 million. He said addressing it would require extensive patching. For customers with a Palo Alto Networks firewall, his company made a virtual patch available, which he said blocks the threat automatically if traffic passes through the firewall. He advised other website operators to install the available fix as soon as possible.

Nikesh believes major vulnerability discoveries may encourage “trophy hunters” to seek the next high-profile find for status. He also said he understood that models expected in the next 2–3 months would have greater capabilities than those currently available and could find vulnerabilities that current models miss. His recommendations to organizations: scan systems regularly, install patches, use virtual patches where systems cannot be fixed immediately, and protect critical infrastructure. He predicted that major breaches could result from these issues.