A startling announcement went out earlier this week: Due to recently discovered vulnerabilities in the open source programming language PHP, website owners had to immediately patch their sites — or if they couldn’t update right away, they should take the sites down to be safe. On this week’s episode of TechCrunch’s Equity podcast, Kirsten Korosec, Sean O’Kane, and I discussed the significance of the PHP-ocalypse and whether we’ll see more incidents like this in the future. Sean called this “a real reckoning moment” that highlights how “when you get down to the bone level of the internet,” everything seems to be “held together by glue and dreams.” And with widespread access to large language models and AI agents, it’s only going to become easier to find these vulnerabilities. (That said, these specific vulnerabilities were found by human researchers, not AI models.) Kirsten, meanwhile, wondered if we’re about to see the “next level of prepper doom […] because you could see how banks could get exploited, and [with] data and privacy concerns, it just feels a lot bigger than we can fix right now.” Keep reading for a preview of our conversation, edited for length and clarity.
Sean O’Kane: The internet is breaking in lots of ways this week, it seems. I think the best way to think about this, if people are coming into this kind of cold: How many times over the last 10 years have we had these moments where something breaks or something nearly breaks, where one person maintaining one tiny repro repository as a hobby or whatever happens to catch that something nefarious is going on and and saves us from the infrastructure of the internet completely crumbling? Now multiply that by a billion, when people have access to not only extremely advanced software in the form of these LLMs that everybody uses, but also the ability to task them to go out and do it themselves, with creating AI agents that are single-minded at accomplishing those things.
We’re seeing a balance of two things happening this week. One is a bunch of the labs and companies like Google and OpenAI actually had people go out and find a bunch of vulnerabilities, including the one with PHP. And then we also have a bunch of people seeming to rush to take advantage of those vulnerabilities to try and hack into websites.
So we have governments taking down websites, we have really popular websites that are going down briefly to be able to fix this vulnerability. This is a real reckoning moment, where we’re going to find out the downside risk of building so much of the internet on open source technology like PHP. When you really get down to the bone level of the internet, it is held together with glue and dreams.
Anthony Ha: There’s so many things that were striking about this. One of them is the fact that — as I understand it, at least — this is not a new vulnerability. This is a vulnerability that has existed in PHP for decades.
And PHP has been used as a programming language to build so much of the web, so this vulnerability has been there for decades, but no one knew about it. What happened is, essentially, that these big AI companies — including Wiz, now owned by Google — they were able to find these vulnerabilities using LLMs. [As noted above, I got this wrong: Human researchers participating in OpenAI and Wiz’s Hack the Planet initiative found the vulnerabilities, though they used AI to exploit the bug.] I guess part of the calculation is, we need to patch this, because if we can find this vulnerability using LLMs, so can other people. But the only way we can get the patch out there is to announce the vulnerability.
Extract — continue reading at the source.
