AI's Ability to Find Security Flaws Exposes Fragile Internet Built on Decades-Old Code

Security researchers recently uncovered critical vulnerabilities in PHP, the open-source language that underpins approximately 70% of all websites. The discovery triggered an urgent call for immediate patching—or, for those unable to update quickly, temporary shutdown altogether. On a recent episode of TechCrunch's Equity podcast, three observers grappled with what this incident reveals about internet infrastructure and where AI-powered vulnerability research might lead next.

A Fragile Foundation Built to Last#

The PHP vulnerabilities expose a troubling paradox at the internet's core. Despite powering millions of websites through platforms like WordPress and Drupal, much of the web runs on technology held together by what one panelist described as "glue and dreams." The most striking aspect: these weaknesses had existed undetected for decades, embedded in software so foundational that many site owners don't even realize they're using it.

The timing amplifies the concern. As machine learning models and AI agents proliferate, finding such vulnerabilities has become dramatically easier. Researchers at companies like Google and OpenAI (through Wiz's Hack the Planet initiative) discovered the PHP flaws using advanced AI tools—but once the vulnerabilities were announced, cybercriminals quickly moved to exploit them. Within hours, millions of attempted attacks targeting the PHP2Shell vector flooded the internet.

The Impossible Disclosure Problem#

Normally, security researchers can disclose vulnerabilities confidentially to a single vendor, keeping the issue contained while fixes roll out. But when the flaw exists across tens of millions of websites using the same open-source library, discretion becomes impractical. Publicizing the vulnerability was necessary to prompt patching, yet the announcement itself became a beacon for malicious actors racing to strike before websites could defend themselves.

The disclosure process itself drew criticism. Some observers felt major AI companies engaged in self-congratulatory announcements that may have accelerated attacker interest, and embargoes appear to have broken early, triggering a cascade of exploitation attempts that Cloudflare CEO Matthew Prince documented reaching millions within days.

The Scale of Unknown Risks#

The real unease centers on what remains hidden. If PHP harbored critical vulnerabilities for 20+ years without detection until AI tools surfaced them, how many other decades-old security flaws sit dormant across the internet's infrastructure? Governments, small businesses, and neighborhood websites now face a compounded threat: not only must they patch rapidly, but many lack the resources and monitoring capabilities that well-capitalized firms like Amazon command. Amazon, running honeypot networks to detect intrusions, observed exploitation attempts before the vulnerability was even publicly disclosed—a luxury few organizations can afford.