Will AI expose the rickety infrastructure of the internet?

Key points

• A newly disclosed PHP vulnerability forced website owners to patch immediately or take sites down.
• PHP underpins content management systems used by roughly 70% of websites, according to the podcast.
• Amazon saw exploitation attempts before the vulnerability was publicly announced, the podcast said.

A newly discovered vulnerability in the open source programming language PHP prompted an urgent warning this week: website owners had to patch their sites immediately or, if they could not update right away, take the sites down to be safe. The issue was discussed on TechCrunch's Equity podcast by Kirsten Korosec, Sean O'Kane and Anthony Ha.

PHP, officially Hypertext Preprocessor, is the core ingredient behind content management systems used throughout WordPress and Drupal, Korosec said, covering something like 70% of websites and tens of millions of sites. Ha said the vulnerability is not new and has existed in PHP for decades but was previously unknown.

Scale and disclosure concerns

O'Kane described the incident as "a real reckoning moment" that reveals how the internet at its base level is held together by glue and dreams. He said AI models and agents will make finding such vulnerabilities easier, though he noted these specific flaws were found by human researchers, not AI models.

Korosec said many people do not realize their websites run on PHP. She also raised link rot, noting that companies, governments and small local sites shutting down rather than patching means online material may no longer be accessible. O'Kane said some people were unhappy with how the disclosure was handled and that a couple of parties got ahead of the embargo, setting off a race among hackers.

When you really get down to the bone level of the internet, it is held together with glue and dreams.

— Sean O'Kane

Early exploitation attempts

Korosec cited a social media post by Cloudflare CEO Matthew Prince about the issue escalating to millions of attempted hacks. She also said Amazon published a blog post describing a honeypot or decoy network that recorded attempts to exploit the vulnerability before it was publicly announced.

Korosec said Amazon has the tools, capital and know-how to fight such threats, while many websites and potentially government sites lack that level of attention. She said the situation could feel bigger than can be fixed right now and wondered whether new startups or open source security tools will emerge in response.