A Stark Warning: The PHP-ocalypse
Earlier this week, a startling announcement sent ripples through the web: due to newly discovered vulnerabilities in the open-source programming language PHP, website owners were urged to patch their sites immediately—or, if they couldn't update in time, take them offline to prevent exploitation.
On this week's episode of TechCrunch's Equity podcast, Kirsten Korosec, Sean O'Kane, and I discussed the significance of the so-called "PHP-ocalypse" and whether we're likely to see more incidents of this kind in the future.
Sean described the situation as "a real reckoning moment" that underscores how, "when you get down to the bone level of the internet," everything seems to be "held together by glue and dreams." With widespread access to large language models (LLMs) and AI agents, finding such vulnerabilities is only going to become easier. (That said, these particular vulnerabilities were discovered by human researchers, not AI models.)
Kirsten, meanwhile, wondered whether we're on the verge of a "next level of prepper doom"—"because you could see how banks could get exploited, and with data and privacy concerns, it just feels a lot bigger than we can fix right now."
Below is a preview of our conversation, edited for length and clarity.
The Internet Is Breaking—In More Ways Than One
Sean O'Kane: The internet is breaking in lots of ways this week, it seems.
For those coming into this cold, here's a useful way to think about it: How many times over the past 10 years have we had moments where something breaks or nearly breaks—where one person maintaining a tiny repo as a hobby happens to catch something nefarious and saves us from the internet's infrastructure completely crumbling?
Now multiply that by a billion, when people have access not only to extremely advanced software in the form of LLMs that everyone uses, but also the ability to task those models to go out and do it themselves—creating AI agents single-mindedly focused on accomplishing those goals.
This week we're seeing two things happen in tandem. First, several labs and companies like Google and OpenAI had people go out and find a bunch of vulnerabilities, including the one in PHP. Second, we have a lot of people rushing to take advantage of those vulnerabilities to try to hack into websites. So we have governments taking down websites, and really popular sites going down briefly to fix the vulnerability.
This is a real reckoning moment, where we're going to find out the downside risk of building so much of the internet on open-source technology like PHP. When you really get down to the bone level of the internet, it is held together with glue and dreams.
Anthony Ha: There were so many striking things about this. One is the fact that—as I understand it, at least—this is not a new vulnerability. This is a vulnerability that has existed in PHP for decades.
PHP has been used to build so much of the web, so this vulnerability has been there for decades, but no one knew about it. What happened is essentially that these big AI companies—including Wiz, now owned by Google—were able to find these vulnerabilities using LLMs. [As noted above, I got this wrong: the researchers who found these vulnerabilities were human.]
via TechCrunch