Will AI expose the rickety infrastructure of the internet?
TechCrunch's Equity podcast discusses the PHP vulnerability fallout, warning that LLMs and AI agents make finding decades-old flaws easier.
Stock photo for illustration only, not from the actual event
- Critical vulnerabilities discovered in PHP, a decades-old open-source programming language.
- Website owners forced to immediately patch their sites or take them offline.
- LLMs and AI agents accelerate both defensive discovery and malicious hacking attempts.
As artificial intelligence technology continues to advance rapidly, a critical question looms over the digital landscape: will AI help secure our digital world, or will it expose the inherent fragility of the internet infrastructure we rely on? This pressing issue was the main topic of discussion on TechCrunch’s Equity podcast on October 24, 2026, featuring hosts Anthony Ha, Kirsten Korosec, and Sean O’Kane as they unpacked the recent turmoil caused by severe vulnerabilities found in the PHP programming language.
The ordeal began with an urgent alert regarding flaws discovered within PHP, the open-source programming language used to build a vast portion of the web. Website owners were instructed to patch their sites immediately or take them offline entirely to prevent potential security breaches, sending shockwaves through the cybersecurity community.
Stock photo for illustration only, not from the actual event
Sean O’Kane described the situation as a true reckoning moment that highlights how deeply fragile the foundational layers of the internet really are. He noted that when you look at the bone level of the internet, everything seems held together merely by glue and dreams, warning that widespread access to large language models and autonomous AI agents will only make uncovering these weak spots easier for bad actors.
"When you really get down to the bone level of the internet, it is held together with glue and dreams."
Sean O’Kane
According to Anthony Ha, what made the incident particularly striking was that the vulnerability was not newly created; rather, it had existed quietly within PHP for decades. Major AI companies, including Wiz (now owned by Google), utilized LLMs to help uncover these hidden flaws. Although it was later clarified that human researchers participating in OpenAI and Wiz’s Hack the Planet initiative actually found the bugs, they still leveraged AI to help exploit them.
The integration of AI and LLMs into vulnerability discovery represents a major paradigm shift in cybersecurity. Historically, finding foundational software flaws required specialized human experts spending months or even years of painstaking code review. AI's ability to analyze massive codebases rapidly condenses this timeline to days, forcing tech firms and developers into a high-stakes race where disclosing a vulnerability to push out a patch inevitably tips off hackers looking to exploit unpatched systems.
Kirsten Korosec shared her concerns that this situation might trigger a broader wave of security panic, noting that many website owners do not even realize their platforms run on PHP—a decades-old open-source language. With potential implications stretching toward banking systems and critical data privacy concerns, the scale of the problem feels immense and difficult to resolve overnight.
Meanwhile, Cloudflare CEO Matthew Prince reported a rapid escalation, noting millions of attempted hacks targeting the PHP2Shell vulnerability shortly after public disclosure. This highlights an ongoing race between administrators rushing to secure their web properties and attackers eager to capitalize on exposed code.
Source: TechCrunch
Found something wrong in this article? Report an issue with this article
Comments
Leave a Comment