Will AI expose the rickety infrastructure of the internet?

Earlier this week, a surprising warning was issued: New security problems had been found in PHP, an open-source programming language. Website owners were told to fix their websites right away. If they could not install the fixes immediately, they were advised to take their websites offline to keep them safe.

On this week's episode of TechCrunch's Equity podcast, Kirsten Korosec, Sean O'Kane, and I discussed why the PHP-ocalypse matters and whether similar incidents are likely to happen again.

Sean called this "a real reckoning moment." He said that when you look at the internet's most basic parts, everything seems to be "held together by glue and dreams." Now that many people can use large language models (LLMs) and AI agents, finding security weaknesses is likely to become easier. However, human researchers, not AI models, found these particular weaknesses.

Kirsten wondered whether we were about to enter an even more frightening period of disaster fears. She said that banks could be attacked and that concerns about data and privacy made the problem feel much bigger than we could fix right now.

Read on for a preview of our conversation, edited to make it shorter and clearer.

Sean O'Kane: It seems like the internet is breaking in many ways this week.

I think the best way to understand this, especially if you're just learning about it, is to think about how many times in the past 10 years something has broken or nearly broken. In some cases, one person looking after a tiny software project as a hobby has happened to notice that something harmful was going on. That person helped stop the internet's basic systems from falling apart.

Now imagine that happening a billion times over. People have access not only to very advanced software in the form of LLMs that many people use, but also to tools that they can tell to carry out tasks on their own. They can create AI agents that focus on one goal and work to achieve it.

We are seeing two things happen at once this week. First, some AI research labs and companies, including Google and OpenAI, had people look for security weaknesses. They found several, including the one in PHP. At the same time, other people seem to be rushing to use these weaknesses to break into websites. Governments are taking some websites offline, and some very popular websites have also gone down briefly so their owners can fix the problem.

This is a moment when we will have to face the risks of building so much of the internet on open-source technology like PHP. When you look at the internet's most basic parts, you find that it is held together with glue and dreams.

Anthony Ha: There were many things about this that stood out to me. One was that, as far as I understand it, this was not a new security weakness. It had existed in PHP for decades.

PHP has been used to build a large part of the web. This weakness had been there for decades, but no one knew about it. What happened was that large AI companies, including Wiz, which Google now owns, were able to find these weaknesses using LLMs. [As noted above, I got this wrong: Human researchers taking part in OpenAI and Wiz's Hack the Planet initiative found the weaknesses, although they used AI to exploit the bug.]

I think part of the reasoning is that we need to fix the problem because if we can find this weakness with LLMs, other people can find it too. But to make the fix available, we have to announce the weakness publicly. This creates a very stressful situation. The message is: "This weakness has existed for decades. You must fix it right away. If you cannot fix it immediately, take your website offline. The weakness is that serious."

Kirsten Korosec: The important thing is that many people do not even know their websites use PHP, the decades-old open-source programming language you mentioned.

For anyone who does not know, PHP stands for Hypertext Preprocessor. It is a basic part of content management systems used by platforms such as WordPress and Drupal. These systems are used by about 70% of websites. We are talking about tens of millions of websites. The scale of this problem is what stands out to me. It also made me think of two things. First, this may only be the beginning. What other old software with serious flaws is still out there, waiting to be attacked?

The second thing is something that 404 Media mentioned in a really good explanation of the problem: link rot. Many people, businesses, governments, and even small neighborhood websites are taking their websites offline. As a result, many links may stop working. Websites that preserve small pieces of history may also become impossible to access instead of being fixed and kept online.

Sean: Anthony, I think you made a very good point. I've seen many people complain about how the security problem was announced. Some were unhappy with what they saw as OpenAI boasting about its role in a post about the issue.

It also seems that a few people shared information before the agreed release time. That set off a race among hackers. I think Matthew Prince, the CEO of Cloudflare, had already posted that he was seeing millions of attempts to attack systems using PHP2Shell.

Here is how security testing usually works. If you test a company's software to find weaknesses, even if that software is a basic part of many computers or internet systems, you can tell the company about the problem privately. The information can stay between the people involved while they work on a fix. But when a weakness affects something as basic and widely used as this, you cannot easily contact everyone privately.

Maybe you could if AI became advanced enough that you could ask a billion agents to email every person responsible for some part of a website. We may now miss the days when website managers were easy to identify, because contacting them might have helped solve the problem. But there is no simple way to handle a situation like this. I think this is the start of a long period of back-and-forth, and a new stage in cybersecurity.

Kirsten: I found Matthew Prince's social media post very revealing, and quite frightening. I do not know if either of you saw this, but Amazon also published a blog post. Amazon is a company with a lot of money, tools, and staff to help it spot what is happening. It runs a network of honeypots, which are decoy systems designed to attract attackers. Amazon actually saw attempts to exploit the weakness before it was announced publicly.

Again, Amazon has the tools, money, and expertise to fight these threats. Many other websites, including some government websites, do not receive the same level of attention or protection. That is the really frightening part to me.

Some people working with AI may take these events as a reason to become even more afraid of possible disasters. You can see how banks might be attacked, and concerns about data and privacy make the whole problem feel much bigger than we can fix right now. I want to see two things. First, how extreme people's reactions will become. Second, whether new startups will emerge because of this, or whether we will turn to some of the open-source tools offered by companies like Nvidia to build new layers of security.