Will AI expose the rickety infrastructure of the internet?

A startling announcement went out earlier this week: Due to recently discovered vulnerabilities in the open source programming language PHP, website owners had to immediately patch their sites — or if they couldn’t update right away, they should take the sites down to be safe. One is a bunch of the labs and companies like Google and OpenAI actually had people go out and find a bunch of vulnerabilities, including the one with PHP. And then we also have a bunch of people seeming to rush to take advantage of those vulnerabilities to try and hack into websites. So we have governments taking down websites, we have really popular websites that are going down briefly to be able to fix this vulnerability. This is a real reckoning moment, where we’re going to find out the downside risk of building so much of the internet on open source technology like PHP. When you really get down to the bone level of the internet, it is held together with glue and dreams.  Anthony Ha: There’s so many things that were striking about this. One of them is the fact that — as I understand it, at least — this is not a new vulnerability. This is a vulnerability that has existed in PHP for decades. And PHP has been used as a programming language to build so much of the web, so this vulnerability has been there for decades, but no one knew about it. What happened is, essentially, that these big AI companies — including Wiz, now owned by Google — they were able to find these vulnerabilities using LLMs. [As noted above, I got this wrong: Human researchers participating in OpenAI and Wiz’s Hack the Planet initiative found the vulnerabilities, though they used AI to exploit the bug.] I guess part of the calculation is, we need to patch this, because if we can find this vulnerability using LLMs, so can other people. But the only way we can get the patch out there is to announce the vulnerability. And so it creates this very panicked situation where [they say]: “Okay, this vulnerability existed for decades. You have to patch right away, and if you can’t patch it right away, just take your website down. It’s that severe a vulnerability.” Kirsten Korosec: I think that the important thing is, a lot of people don’t even realize that their websites have PHP — which is this, as you mentioned, decades-old open source programming language.  For those who don’t know, Hypertext Preprocessor is the official term, [it’s] this really the core ingredient behind content management systems that are used throughout WordPress, Drupal, something like 70% of websites.