A shocking announcement was made earlier this week: Due to newly identified vulnerabilities in the open-source programming language PHP, website owners were urged to promptly patch their sites. If immediate updates were not feasible, they were advised to take their sites offline as a precaution. In this week’s episode of the Equity podcast, Kirsten Korosec, Sean O’Kane, and I examined the implications of the PHP-ocalypse and contemplated the likelihood of similar incidents occurring in the future. Sean referred to this as “a real reckoning moment,” emphasizing that “when you get down to the bone level of the internet,” everything appears to be “held together by glue and dreams.” With the increasing accessibility of large language models and AI agents, the discovery of such vulnerabilities is likely to become easier. (It is important to note that these specific vulnerabilities were identified by human researchers, not AI models.) Kirsten expressed concern that we might be on the brink of a “next level of prepper doom,” suggesting that the potential for exploitation of banks and the growing data and privacy concerns make the situation feel significantly more serious than we can currently address. Continue reading for a summary of our discussion, edited for brevity and clarity.
Sean O’Kane: It seems the internet is experiencing multiple breakdowns this week. For those unfamiliar with the context, consider how many times in the past decade we have encountered moments where something fails or nearly fails, often due to a single individual maintaining a minor repository who inadvertently uncovers something malicious, thereby preventing a complete collapse of internet infrastructure. Now, imagine multiplying that scenario by a billion, as individuals gain access not only to highly advanced software in the form of these widely used LLMs but also the capability to direct them to autonomously identify such issues, creating AI agents focused on achieving these tasks. This week, we are witnessing a convergence of two phenomena: several labs and companies, including Google and OpenAI, have deployed personnel to uncover numerous vulnerabilities, including the one affecting PHP. Concurrently, there appears to be a rush among various individuals to exploit these vulnerabilities in an attempt to hack into websites. Consequently, we see governments taking down websites, and many popular sites experiencing brief outages to address this vulnerability. This represents a significant reckoning moment, as we begin to understand the risks associated with constructing much of the internet on open-source technologies like PHP. At its core, the internet is fundamentally held together by glue and dreams.
Anthony Ha: There are several striking aspects to this situation. One notable point is that, as I understand it, this vulnerability is not new; it has existed in PHP for decades. Given that PHP has been a foundational programming language for a significant portion of the web, this vulnerability has persisted unnoticed for many years. Essentially, major AI companies, including Wiz, now under Google’s ownership, managed to identify these vulnerabilities using LLMs. [As previously mentioned, I initially misstated this: Human researchers involved in OpenAI and Wiz’s Hack the Planet initiative discovered the vulnerabilities, although they utilized AI to exploit the bug.] Part of the rationale is that we must address this vulnerability, as if we can identify it using LLMs, so too can others. However, the only means to disseminate the patch is to publicly announce the vulnerability, creating a state of panic where they declare: “This vulnerability has existed for decades. You must patch immediately, and if you cannot do so, take your website offline. The severity of this vulnerability cannot be overstated.”
Kirsten Korosec: It is crucial to recognize that many individuals are unaware that their websites utilize PHP, which, as you noted, is a decades-old open-source programming language. For those unfamiliar, Hypertext Preprocessor is the official term, and it serves as a fundamental component behind content management systems used across platforms like WordPress and Drupal, accounting for approximately 70% of websites. We are discussing tens of millions of sites. To me, the scale is alarming. It also prompted me to consider two things immediately: First, this may just be the beginning. What other outdated software is out there that could be exploited? Secondly, 404 Media provided an insightful analysis regarding link rot. Many individuals, companies, and governments, including small local websites, are taking these sites offline. This will lead to significant link rot and the loss of access to websites that may have contained historical information, rather than opting for patches.
Sean: Anthony, you made an excellent point. I have noticed considerable dissatisfaction regarding the rollout of the disclosure, particularly the self-congratulatory tone that OpenAI adopted in its announcement. Additionally, it appears that some individuals may have jumped the gun on the embargo surrounding this release, triggering a race among hackers. I believe it was Cloudflare CEO Matthew Prince who mentioned observing a surge in attempted hacks of PHP2Shell, escalating to millions. In cybersecurity, the typical protocol for addressing vulnerabilities involves disclosing them discreetly to the relevant company, even if they pertain to fundamental software that supports various systems or aspects of the internet. However, when dealing with something as integral as this, discreet communication is not feasible. Perhaps if AI were sufficiently advanced, one could deploy a billion agents to send emails to every individual responsible for some aspect of a website. We now find ourselves lamenting the days when webmasters were easily identifiable, which might have mitigated the issue to some extent. Yet, there is no straightforward solution. I believe this marks the beginning of an ongoing dialogue and clearly a new frontier in cybersecurity.
Kirsten: Matthew Prince’s social media post was particularly revealing and quite alarming. Furthermore, I don’t know if either of you noticed, but Amazon also released a blog post. Being a well-capitalized company, they possess the resources and expertise to monitor such developments. They essentially operate a honeypot network or decoy and observed attempts to exploit this vulnerability prior to its public announcement. This reinforces the notion that Amazon has the tools and capital to combat these threats, while numerous websites, including potentially government sites, lack such attention. This, to me, is the most concerning aspect. Additionally, there are AI employees who may escalate this situation to a new level of “prepper doom,” as one can envision how banks could be targeted, and with the rising data and privacy issues, the scope of the problem feels far beyond our current capacity to resolve. I am curious to see two outcomes: first, how extreme individuals’ reactions become, and second, whether new startups will emerge in response to this, or if we will turn to some of the open-source tools provided by companies like Nvidia to establish these security layers.
