Will AI reveal the Internet’s rickety infrastructure?

A surprising announcement came out earlier this week: Due to recently discovered vulnerabilities in the open source programming language PHP, website owners had to immediately update their sites – or if they couldn’t update immediately, they had to shut down the sites for security reasons.

On this week’s episode of TechCrunch’s Equity podcast, Kirsten Korosec, Sean O’Kane and I discussed the importance of PHP-ocalypse and whether we’ll see more incidents like this in the future.

Sean called it a “real wake-up call” that highlights how “when you get down to the bone level of the Internet” everything seems to be “held together by glue and dreams.” And with widespread access to large language models and AI agents, it will become even easier to find these vulnerabilities. (That said, these specific vulnerabilities were discovered by human researchers, not AI models.)

Kirsten, meanwhile, wonders if we’re about to see “the next level of preppers disaster[…]because you could see how the banks could be exploited, and (with) the data and privacy issues, that seems way bigger than what we can solve right now.” »

Keep reading for a preview of our conversation, edited for length and clarity.

Sean O’Kane: The internet seems to be down in many ways this week.

I think the best way to think about it, if people find themselves in this kind of cold: How many times in the last 10 years have we had these moments where something breaks or something almost breaks, where a person maintains a tiny repository of reproductions as a hobby or whatever only to realize that something nefarious is happening and saving us from the infrastructure of the Internet completely collapsing?

Now multiply that by a billion, when people will have access not only to extremely advanced software in the form of these LLMs that everyone uses, but also the ability to task them with going out and doing it themselves, creating AI agents determined to accomplish these things.

We’re seeing a balance of two things happening this week. One is that a group of labs and companies like Google and OpenAI have asked people to find a number of vulnerabilities, including the one in PHP. And then we also have a group of people who seem to be rushing to take advantage of these vulnerabilities to try to hack websites. So we have governments taking down websites, very popular websites going down briefly to be able to patch this vulnerability.

This is a real moment of reflection, where we will discover the downside risk of building a large part of the Internet on open source technologies like PHP. When you really get down to the bone level of the Internet, everything is held together by glue and dreams.

Anthony Ha: There were so many things that were striking about it. One of them is the fact that – as I understand it – this is not a new vulnerability. This is a vulnerability that has existed in PHP for decades.

And PHP was used as the programming language to create much of the web, so this vulnerability has been around for decades, but no one knew about it. What happened, essentially, was that these big AI companies – including Wiz, now owned by Google – were able to find these vulnerabilities using LLM. (As noted above, I was wrong: human researchers participating in OpenAI and Wiz’s Hack the Planet initiative discovered the vulnerabilities, although they used AI to exploit the bug.)

I guess part of the calculus is that we need to fix this, because if we can find this vulnerability using LLM, other people can too. But the only way to release the patch is to announce the vulnerability. So it creates a very panicked situation where (they say), “Okay, this vulnerability has been around for decades. You need to patch it immediately, and if you can’t patch it immediately, just take down your website. It’s a vulnerability that serious.”

Kirsten Korosec: I think what’s important is that many people don’t even realize that their websites use PHP, which is, as you mentioned, a decades-old open source programming language.

For those who don’t know, Hypertext Preprocessor is the official term, it’s really the main ingredient in content management systems that are used in WordPress, Drupal and around 70% of websites. We’re talking tens of millions of websites. So for me, it’s scale. It also immediately made me think of two things: First, this is only the beginning. What other decades-old bad software could be exploited?

And the other one was something that 404 Media, which had a very bad outage, mentioned, which was link rot. Because a lot of people, businesses, governments, maybe this little neighborhood website, they’re shutting down these (websites). And so we’re going to have so many lousy links and also websites that maybe had a little piece of history that will no longer be accessible, instead of fixing it.

Sean: Anthony, I think you made a very good point. I’ve seen a lot of people unhappy with the disclosure rollout here, a bit of the chest beating that OpenAI seems to have done in their article about it.

Additionally, it appears that a few people have pre-empted the embargo on this release, which has sparked a race among hackers. I think it was Matthew Prince, CEO of Cloudflare (who) who already talked about seeing this escalate into millions of attempts to hack PHP2Shell.

The problem with these vulnerabilities, the way it generally works in cybersecurity is if you test a company’s software, even if it’s fundamental software that helps run many different computers or parts of the Internet or whatever, you can go to that company and disclose it and it kind of stays in this bubble. But when we’re talking about something as deep and as fundamental as this, you can’t tell everyone quietly.

I mean, maybe you could, if AI was advanced enough and you could task a billion agents with sending an email to every person who controls part of a website. We now miss the days when we had easily identifiable webmasters, and perhaps that would have solved the problem to some extent. But there is simply no easy way to do this. I think this is the start of what is going to be a lot of back and forth and clearly a new frontier in cybersecurity.

Kirsten: Matthew Prince’s post on social media was very eye-opening and quite frightening to me. Also, I don’t know if any of you saw this, but Amazon also published a blog post. They’re a very well-capitalized company, so they have the tools and a team to understand what’s going on. They’re basically operating a network of honeypots, or a decoy, and they actually found that there were attempts to exploit this vulnerability before it was publicly announced.

To me, again, it comes down to this: Amazon has the tools, the capital, and the know-how to fight these things. There are so many websites and even potentially government websites that just don’t get this level of attention. And so for me, that’s really what’s scary.

And there (are) AI employees that are probably going to be taken to the next level, like a disaster, because you could see how the banks could be exploited, and (with) the data and privacy issues, that seems way bigger than what we can solve right now. So I’m interested to see two things. First, how extreme people’s behavior is becoming – but I also wonder if new startups will arise as a result of this, or if we will turn to some of the open source tools (offered by companies like Nvidia) to create these layers of security.