A warning went out this week that website owners must patch their sites immediately or take them offline. The urgent notice concerned vulnerabilities discovered in PHP, an open source programming language powering tens of millions of websites.
On TechCrunch’s Equity podcast, hosts Kirsten Korosec, Sean O’Kane, and I discussed the incident. We debated whether this event, which has been called the PHP-ocalypse, would lead to more security failures in the future.
Sean described the situation as a reckoning. He noted that at the foundational level of the internet, systems are held together by glue and dreams. He added that widespread access to large language models and AI agents will make it easier to find such flaws. Human researchers found these specific bugs, not AI models.
Kirsten questioned if this marks the next level of prepper doom. She pointed out that banks could be exploited and data privacy concerns could expand beyond current repair capabilities.
The conversation
Sean noted that the internet was breaking in multiple ways during this week.
He suggested people consider how often something breaks or nearly breaks over the last decade. Usually, one person maintaining a tiny repository catches a nefarious issue and prevents the infrastructure from crumbling. Now multiply that by a billion when people use advanced software like LLMs and task them with specific actions.
Two things happened simultaneously. Labs and companies including Google and OpenAI sent people to find vulnerabilities, including the PHP issue. At the same time, others rushed to exploit those vulnerabilities to hack websites. Governments took down sites and popular websites went down briefly to fix the bug.
This is a reckoning moment revealing the downside risk of building the internet on open source technology like PHP. At the bone level, the system relies on glue and dreams.
Anthony highlighted that the vulnerability existed in PHP for decades. The language builds much of the web, yet no one knew about the flaw until recently. Large AI companies, including Wiz, now owned by Google, found the vulnerabilities using LLMs. Human researchers participating in OpenAI and Wiz’s Hack the Planet initiative actually found the bugs, though they used AI to exploit them.
The calculation is simple. We must patch the flaw because if LLMs can find it, others can too. The only way to release the patch is to announce the vulnerability. This creates a panicked situation where owners must patch immediately or shut down their sites.
Kirsten noted that many people do not realise their websites use PHP. Hypertext Preprocessor is the official term. It is the core ingredient behind content management systems used in WordPress and Drupal. About 70% of websites, or tens of millions, rely on it.
To her, the scale is the issue. She wondered what other decades-old bad software is out there waiting to be exploited. She also mentioned link rot. As companies and governments shut down websites, history and small neighbourhood sites may become inaccessible instead of being patched.
Sean agreed with Anthony’s point. He saw unhappiness regarding the disclosure rollout and the chest beating from OpenAI’s post. A couple of people got ahead of the embargo, setting off a race among hackers. Cloudflare CEO Matthew Prince already posted about millions of attempted hacks of the PHP2Shell.
In cybersecurity, stress testing a company’s software usually stays within a bubble. You disclose the issue to the company and it remains contained. This does not apply to something as deep and fundamental as PHP. You cannot tell everyone discreetly. Perhaps AI could task a billion agents to email every person controlling a website part, but we are no longer in the days of easily identifiable webmasters. There is no easy solution. This is the beginning of a new frontier in cybersecurity.
Kirsten found Matthew Prince’s social media post telling and scary. She also noted Amazon’s blog post. The company has the tools, capital, and team to catch what is happening. It operates a honeypot network, a decoy system, and saw attempts to exploit the vulnerability before it was publicly announced.
Kirsten argued that Amazon has the resources to fight these threats. Many websites and government sites lack that level of attention. That is the scary part. Some AI employees might take this to a higher level of prepper doom. Banks could be exploited, and data privacy concerns feel bigger than current repair methods. She wanted to see how extreme human behaviour becomes and if new startups will emerge or if we turn to open source tools from companies like Nvidia to create security layers.
