Website owners were told this week to immediately patch their sites against newly discovered vulnerabilities in the open source programming language PHP, or take the sites down if they could not update right away. The warning followed an announcement that set off urgent remediation across the web, and it became the subject of discussion on TechCrunch's Equity podcast, where Kirsten Korosec, Sean O'Kane and Anthony Ha weighed what the incident reveals about the internet's underlying infrastructure.
O'Kane described the episode as a genuine moment of reckoning that shows how the internet at its deepest level is held together loosely. He said the coming era of large language models and AI agents will make finding such vulnerabilities easier, though he noted these particular flaws were found by human researchers rather than AI models. Korosec said the episode raised fears of a next level of doom, pointing to the potential for banks to be exploited and to data and privacy concerns that feel larger than can currently be fixed.
The vulnerability is not new, according to Ha. It had existed in PHP for decades without being known, and it came to light through security work involving the AI companies, including Wiz, which is now owned by Google. Ha initially said the flaws were found using LLMs, then corrected himself: human researchers participating in OpenAI and Wiz's Hack the Planet initiative found the vulnerabilities, though they used AI to exploit the bug. The calculation behind the disclosure, he said, was that if the flaw could be found with LLMs, others could find it too, and the only way to distribute a patch was to announce it.
Korosec noted that many people do not realize their websites run on PHP, the open source language officially known as Hypertext Preprocessor that underpins content management systems including WordPress and Drupal. She put the share of websites involved at something like 70%, or tens of millions of sites. She also pointed to link rot, citing a breakdown by 404 Media, because many companies, governments and small neighborhood sites are shutting down rather than patching, leaving pieces of history inaccessible. She said the scale made her think this is only the beginning and wonder what other decades-old bad software will be exploited.
O'Kane said many people are unhappy with how the disclosure was handled, including what he characterized as chest beating in OpenAI's post about it, and that a couple of people got ahead of the embargo, setting off a race among hackers. He cited Cloudflare CEO Matthew Prince as having already posted about escalation to millions of attempted hacks of the PHP2Shell. O'Kane said vulnerabilities in ordinary company software can be disclosed discreetly, but something as fundamental as this cannot be, and he said the episode marks a new frontier in cybersecurity.
Korosec called Prince's social media post telling and scary. She also noted that Amazon published a blog post describing how its honeypot, or decoy, network saw attempts to exploit the vulnerability before it was publicly announced. Amazon has the tools, capital and know-how to defend itself, she said, while many websites and potentially government sites do not. She said she is watching both how extreme people's behavior becomes and whether new startups emerge, or whether companies turn to open source tools such as those offered by Nvidia, to build security layers.
More AI news from TechManNews.
