AI Is Changing Everything About Hacking. No One Knows What Happens Next
404 Media Jason Koebler ● Covered by 12 sources
AI tools just helped find fresh bugs in PHP and other services, and exploit attempts spiked fast. It’s making both hackers and defenders move faster than the internet can handle.
Based on reporting by 404 Media, Jason Koebler — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
For most of the past month, security people have sounded spooked. Some are warning about an AI-driven “Black Swan” moment. Others are just telling everyone to patch, turn on two-factor authentication, and hope the blast radius stays small. Matthew Green, the Johns Hopkins cryptographer, said the internet is “dry tinder” with teenagers still looking for matches. That’s the mood.
Then the bugs started landing. AI-assisted research surfaced issues in PHP, plus vulnerabilities or problems in eMudhra, Node.js, Gitlab, Plex, Railway, OpenCode, and other services. The PHP one, dubbed PHP2Shell, drew the loudest reaction. Matthew Prince of Cloudflare said exploit attempts jumped from thousands before public announcement to tens of thousands within 45 minutes, hundreds of thousands within two hours, and millions after that.
The bigger story isn’t that AI is magic. It’s that it makes the old, ugly truth of software security much easier to see. A lot of internet infrastructure is out of date, forgotten, or maintained by people who are long gone. AI and large language models can help skilled researchers find flaws faster, but they also make it cheap to go door-handle checking across huge swaths of software. Sometimes the door is locked. Sometimes it’s open. Sometimes there’s a hole in the wall.
That speed cuts both ways. OpenAI says the PHP work showed how AI can find internet-scale flaws, but also help attackers build exploits faster. Chainguard got criticized for posting fixes before official disclosure was done. Dan Lorenc said his team found the same bugs by asking a frontier model to find bad PHP vulnerabilities. Amazon said it saw exploit attempts before the disclosure, which only adds to the fog. The neat disclosure process security folks like to believe in is getting squeezed.
So far, the most visible damage has been defensive: patches, takedowns, and services pulled offline before anyone could break them. That includes 4chan, some Wikimedia services, and Archive.org. The ugly part is that some historic sites may never come back. AI didn’t invent insecure software. It just gave everyone a faster way to find out how much of the internet was held together by luck and stale code.
My take — AI-written commentary, not fact-checked reporting
This is the part where the “AI safety” crowd and the “just ship it” crowd both get a slap. The models are not the problem by themselves; the problem is the pile of ancient, half-forgotten software pretending to be a modern internet. AI just found the loose bricks faster, which is deeply rude but also very on-brand for the industry.
Read more about this at: 404 Media