Website owners were told this week to patch their sites immediately to fix a vulnerability in PHP, the open source programming language. If they couldn’t update right away, the advice was to take the sites down until they could. Governments pulled some of their websites offline, and several popular sites went dark briefly while the fix rolled out.

The flaw is not new. Anthony Ha, a TechCrunch reporter speaking on this week’s episode of the Equity podcast, said the vulnerability had sat in PHP for decades, and nobody had noticed it. Human researchers taking part in OpenAI and Wiz’s Hack the Planet initiative found the bugs, Ha said, correcting an earlier statement he had made during the discussion. Those researchers used AI to exploit the bug. Wiz is now owned by Google.

Ha described the bind facing security teams. Once a flaw like this is found, the only way to get a patch to website operators is to announce it. That announcement also tells attackers exactly where to look. The result, he said, is a panicked scramble: “Okay, this vulnerability existed for decades. You have to patch right away, and if you can’t patch it right away, just take your website down. It’s that severe a vulnerability.”

Kirsten Korosec, also on the podcast, pointed to the sheer reach of the software. PHP, which stands for Hypertext Preprocessor, sits behind content management systems such as WordPress and Drupal. She cited a figure of something like 70 percent of websites, or tens of millions of sites. Many of the people running those sites, she said, don’t even know PHP is part of the stack.

Sean O’Kane called the moment “a real reckoning.” He said that when you get down to the bottom layer of the internet, it is “held together with glue and dreams.” Widespread access to large language models and AI agents, he argued, will make these kinds of vulnerabilities easier to find over time. He was careful to note that the specific PHP flaws were found by people, not AI models, though the same tools are now in the hands of many more users.

The disclosure itself drew criticism. O’Kane said he had seen many people unhappy with how the news was rolled out, and he pointed to what he described as chest-beating in an OpenAI post about it. He also said a few people got ahead of the embargo, which set off a race among hackers. Cloudflare CEO Matthew Prince posted that attempted hacks had escalated to millions, targeting what he called PHP2Shell.

O’Kane explained that in cybersecurity, a flaw in one company’s software can usually be reported privately and stay contained. A problem this deep in the stack can’t be handled that way. “You can’t go around and tell everybody discreetly,” he said. He added that the days of easily identifiable webmasters, who could have been contacted directly, are gone.

Korosec raised the Amazon angle. Amazon published a blog post saying its honeypot network, a set of decoy systems designed to attract attackers, had seen attempts to exploit the vulnerability before it was publicly announced. Korosec said large, well-funded companies have the tools, staff and know-how to respond. Many smaller websites, and some government sites, do not have that level of attention, and she called that the scariest part.

She also worried about what comes next. Citing a breakdown from 404 Media, Korosec said that when sites are shut down rather than patched, the result is link rot, and small pieces of web history may disappear. She wondered how far some people might take the fallout, noting that banks could be targeted and that data and privacy concerns make the problem feel bigger than anyone can fix right now.

Korosec said she is watching two things. One is how people react. The other is whether new startups emerge to address the gap, or whether companies turn to open source security tools, including some offered by Nvidia, to build new layers of protection.

Questo articolo è stato scritto con l'assistenza dell'IA.
News Factory APP - notizie agentiche per potenziare il tuo SEO e AEO.