A surprising announcement was made earlier this week: due to recently discovered vulnerabilities in the open source programming language PHP, website owners had to immediately patch their sites, or if they couldn’t update them immediately, they would have to shut down the sites to be safe. On this week’s episode of TechCrunch’s Equity podcast, Kirsten Korosec, Sean O’Kane and I discuss the importance of PHP-ocalypse and whether we’ll see more incidents like it in the future. Sean called this “a real moment of reckoning” that highlights how “when you get down to the basic level of the Internet,” everything seems to be “held together by glue and dreams.” And with widespread access to large language models and AI agents, it will be easier to find these vulnerabilities. (That said, these specific vulnerabilities were found by human researchers, not AI models.) Meanwhile, Kirsten wondered if we’re about to see the “next level of prepper doom.” […] because you could see how the banks could be exploited, and [with] concerns about data and privacy, it just feels so much bigger than what we can fix right now.” Continue reading for a preview of our conversation, edited for length and clarity. Sean O’Kane: It seems like the Internet is breaking in a lot of ways this week. I think the best way to think about this, if people are coming into this kind of cold: How many times in the last 10 years have we had these moments where something breaks or something almost breaks, where one person holds a little streaming repository as a hobby or whatever happens to realize that something nefarious is happening and save us from the Internet infrastructure completely falling apart? Now multiply that by a billion, when people have access not only to extremely advanced software in the form of these LLMs that everyone uses, but also the ability to task them to go out and do it themselves, with the creation of AI agents that are determined to achieve those things. We’re seeing a balance of two things happening this week. One is a group of labs and companies like Google and OpenAI that had people go out and find a bunch of vulnerabilities, including PHP. And then we also have a group of people who seem to be rushing to exploit those vulnerabilities to try to hack websites. We have governments shutting down websites, we have very popular websites shutting down briefly in order to fix this vulnerability. basic level of the internet, this is held together with glue and dreams. Anthony Ha: One of them is the fact that, at least as I understand it, this is a vulnerability that has existed in PHP for decades. And PHP has been used as a programming language to build much of the web, so this vulnerability has been there for decades, but no one knew it. Google, they were able to find these vulnerabilities using LLM. [As noted above, I got this wrong: Human researchers participating in OpenAI and Wiz’s Hack the Planet initiative found the vulnerabilities, though they used AI to exploit the bug.]
I guess part of the calculation is that we need to patch this, because if we can find this vulnerability using LLM, other people can too. But the only way to publish the patch is to announce the vulnerability. And then this panic situation is created where [they say]: “Okay, this vulnerability has been around for decades. You have to patch it right away, and if you can’t patch it right away, just shut down your website. It’s that serious of a vulnerability.” Kirsten Korosec: I think the important thing is that a lot of people don’t even realize that their websites have PHP, which is, as you mentioned, a decades-old open source programming language. For those who don’t know, Hypertext Preprocessor is the official term. [it’s] This is really the core ingredient behind content management systems used in WordPress, Drupal and about 70% of websites. We are talking about tens of millions of websites. So, for me, it’s scale. It also immediately made me think of two things: One, this is just the beginning. What other decades-old malware exists that could be exploited? And the other one was something that 404 Media mentioned, which had a big breakdown, which is the rotten link. Because many people, companies, governments, maybe that little neighborhood website, are closing these [websites] below. And then we’re going to have a lot of rotten links and also websites that maybe had a little bit of history that will no longer be accessible, instead of patching them. Sean: Anthony, I think you made a very good point. I’ve seen a lot of people unhappy with the release of the disclosure here, a bit of the beating OpenAI seems to have done in their post about it. Additionally, it seems that a couple of people got ahead of the embargo on this release, sparking a race among hackers. I think it was Cloudflare CEO Matthew Prince. [who] I already posted about seeing it escalate to millions of PHP2Shell hack attempts. The problem with these vulnerabilities, the way this usually works in cybersecurity is that if you’re stress testing a company’s software, even if it’s a critical piece of software that helps run many different computers or parts of the Internet or whatever, you can go to that company and reveal it and it somehow stays within that bubble. But when we’re talking about something as deep and fundamental as this, you can’t go around and tell everyone discreetly. I mean, maybe you could, if AI was advanced enough and you could task a billion agents to send an email to every person who has control over any part of a website. We now regret the days when we had webmasters who were easily identifiable, and perhaps that would have solved the problem to some extent. But there is simply no easy way to do this. I think this is the beginning of what will be many comings and goings and clearly a new frontier in cybersecurity. Kirsten: Matthew Prince’s post on social media was really eye-opening and quite scary for me. Also, I don’t know if any of you saw this, but Amazon also published a blog post. This is a very well capitalized company, so they have the tools and a team to detect what is happening. They operate, basically, a honeypot network, or a decoy, and they actually saw that there were attempts to exploit that vulnerability before it was publicly announced. For me, again, it all comes down to this: Amazon has the tools, the capital, and the knowledge to fight these things. There are so many websites and even potentially government websites that just don’t get that level of attention. And to me, that’s really the scary part. and there [are] some AI employees out there who will probably take this to the next level of preparatory doom, because you could see how the banks could be exploited, and [with] Concerns about data and privacy simply seem much bigger than we can address at this time. So I’m interested in seeing two things. First, how extreme people’s behavior becomes, but I also wonder if some new companies will emerge as a result of this, or if we will turn to some of the open source tools. [offered by companies like Nvidia] to create these layers of security. When you buy through links in our articles, we may earn a small commission. This does not affect our editorial independence.