A shocking revelation emerged earlier this week: website operators were forced to urgently patch their sites—or shut them down entirely if immediate updates weren't possible—due to newly uncovered security flaws in the open-source programming language PHP. Sean described this as "a real reckoning moment" that underscores how "when you get down to the bone level of the internet," everything appears to be "held together by glue and dreams." As large language models and AI agents become more widely accessible, discovering such vulnerabilities will only grow easier. (It's worth noting, however, that these particular flaws were identified by human researchers, not AI systems.)

Kirsten, for her part, questioned whether we're on the verge of witnessing "the next level of prepper doom […] because you could see how banks could get exploited, and [with] data and privacy concerns, it just feels a lot bigger than we can fix right now."

The following is an excerpt from our discussion, lightly edited for brevity and clarity.

**Sean:** It seems like the internet is fracturing in numerous ways this week. For those just tuning in, here's a useful way to frame it: Think about how many times over the past decade we've experienced near-catastrophic breakdowns—situations where a single individual maintaining some tiny repository as a side project happened to detect something malicious and prevented the entire internet infrastructure from collapsing. Now imagine multiplying that scenario by a billion, when people not only have access to incredibly sophisticated software like these LLMs but can also deploy them to autonomously seek out and exploit weaknesses through AI agents designed with singular focus on those tasks.

What we're witnessing this week is a dual dynamic. On one hand, several labs and companies—Google and OpenAI among them—actually dispatched people to uncover numerous vulnerabilities, including the PHP one. Simultaneously, many others appear to be racing to exploit those same vulnerabilities, attempting to breach websites. Governments are pulling sites offline; popular websites are briefly going dark to apply fixes. This truly is a reckoning moment—we're about to discover the downside risks of building so much of the internet on open-source technology like PHP. When you strip away the layers and look at the internet's core, it's held together with glue and dreams.

**Anthony:** So many aspects of this were striking. For one—at least as I understand it—this isn't a new vulnerability. It's one that's existed in PHP for decades. PHP has been used to build so much of the web, so this flaw has been lurking for decades, but nobody knew about it. What essentially happened is that these major AI companies—including Wiz, now owned by Google—were able to identify these vulnerabilities using LLMs. [As noted above, I got this wrong: Human researchers participating in OpenAI and Wiz's Hack the Planet initiative found the vulnerabilities, though they used AI to exploit the bug.]

Part of the reasoning, I suppose, is that we need to patch this because if we can find this vulnerability using LLMs, so can others. But the only way to distribute the patch is to disclose the vulnerability. That creates this highly panicked situation where [they say]: "Okay, this vulnerability existed for decades. You must patch immediately, and if you can't patch immediately, just take your website down. It's that severe."

**Kirsten:** What's crucial to understand is that many people don't even realize their websites run on PHP—which, as you mentioned, is this decades-old open-source programming language. For those unfamiliar, Hypertext Preprocessor is the official name; it's really the core ingredient behind content management systems used across WordPress, Drupal, and roughly 70% of websites. We're talking tens of millions of websites. So for me, it's the sheer scale. It also immediately prompted two thoughts: First, this is just the beginning. What other decades-old flawed software is out there waiting to be exploited? And second, something that 404 Media—which had an excellent breakdown—mentioned: link rot. Because many people, companies, governments, perhaps that small neighborhood website, they're shutting these [websites] down. So we're going to see massive link rot and websites that maybe held a little piece of history that will no longer be accessible, rather than being patched.

**Sean:** Anthony, I think you made a really good point. I've seen a lot of people unhappy with how the disclosure rolled out here—a bit of chest-beating that OpenAI seems to have done in its post about it. Also, it seems like a couple people got ahead of the embargo on this release, which triggered a race among the hacker community. I think it was Cloudflare CEO Matthew Prince [who] already posted about seeing it escalate to millions of attempted hacks of the PHP2Shell. The thing with these vulnerabilities—the way cybersecurity typically works is, if you're stress-testing a company's software, even if it's a fundamental piece of software that helps run many different computers or parts of the internet or whatever it might be, you can go to that company and disclose it, and it sort of stays within that bubble. But when we're talking about something as deep and as fundamental as this, you can't go around telling everybody discreetly. I mean, maybe you could, if the AI was advanced enough and you could task a billion agents to send an email to every single person who has control over some part of a website. We're now lamenting the days when we had webmasters who were easily identifiable—maybe that would have solved the problem to some extent. But there's just no easy way to do this. I think this is the beginning of what's going to be a lot of back and forth and clearly a new frontier in cybersecurity.

**Kirsten:** Matthew Prince's social media post was really telling to me, and pretty scary. Also, I don't know if either of you saw this, but Amazon also published a blog post. This is a very well-capitalized company, so they have the tools and a team to catch what's going on. They operate, basically, a honeypot network, or a decoy, and they actually observed attempts to exploit that vulnerability before it had been publicly announced. To me, again, it comes back to this: Amazon has the tools, the capital, and the know-how to fight these things. There are so many websites and even potentially government websites that simply don't have that level of attention. And so to me, that's really the scary part. And there [are] some AI employees out there who are probably going to take this to the next level of prepper doom, because you could see how banks could get exploited, and [with] data and privacy concerns, it just feels a lot bigger than we can fix right now. So I'm interested to see two things: One, how extreme people's behavior gets—but also I'm wondering if some new startups are going to emerge as a result of this, or if we're going to turn to some of the open-source tools [offered by companies like Nvidia] to create these security layers.