本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

Will AI expose the rickety infrastructure of the internet?

A startling announcement went out earlier this week: Due to recently discovered vulnerabilities in the open source programming language PHP, website owners had to immediately patch their sites — or if they couldn’t update right away, they should take the sites down to be safe. On this week’s episode of TechCrunch’s Equity podcast, Kirsten Korosec, Sean O’Kane, and I discussed the significance of the PHP-ocalypse and whether we’ll see more incidents like this in the future. Sean called this “a real reckoning moment” that highlights how “when you get down to the bone level of the internet,” everything seems to be “held together by glue and dreams.” And with widespread access to large language models and AI agents, it’s only going to become easier to find these vulnerabilities. (That said, these specific vulnerabilities were found by human researchers, not AI models.) Kirsten, meanwhile, wondered if we’re about to see the “next level of prepper doom […] because you could see how banks could get exploited, and [with] data and privacy concerns, it just feels a lot bigger than we can fix right now.” Keep reading for a preview of our conversation, edited for length and clarity.

本周早些时候发布了一则令人震惊的消息：由于最近在开源编程语言 PHP 中发现了漏洞，网站所有者必须立即修补其网站——如果无法立即更新，则应为了安全起见将网站下线。在本周的 TechCrunch Equity 播客节目中，Kirsten Korosec、Sean O’Kane 和我讨论了“PHP 末日”的意义，以及未来我们是否会看到更多此类事件。Sean 将此称为“一个真正的清算时刻”，它凸显了“当你深入到互联网的骨干层面时”，一切似乎都是“靠胶水和梦想维系的”。随着大型语言模型和人工智能代理的广泛普及，发现这些漏洞只会变得越来越容易。（话虽如此，这些特定的漏洞是由人类研究人员发现的，而非人工智能模型。）与此同时，Kirsten 想知道我们是否即将看到“下一阶段的末日生存主义……因为你可以预见银行是如何被利用的，再加上数据和隐私问题，这感觉比我们目前能解决的问题要大得多。”请继续阅读我们对话的节选，内容经过编辑以求简洁明了。

Sean O’Kane: The internet is breaking in lots of ways this week, it seems. I think the best way to think about this, if people are coming into this kind of cold: How many times over the last 10 years have we had these moments where something breaks or something nearly breaks, where one person maintaining one tiny repro repository as a hobby or whatever happens to catch that something nefarious is going on and and saves us from the infrastructure of the internet completely crumbling? Now multiply that by a billion, when people have access to not only extremely advanced software in the form of these LLMs that everybody uses, but also the ability to task them to go out and do it themselves, with creating AI agents that are single-minded at accomplishing those things. We’re seeing a balance of two things happening this week. One is a bunch of the labs and companies like Google and OpenAI actually had people go out and find a bunch of vulnerabilities, including the one with PHP. And then we also have a bunch of people seeming to rush to take advantage of those vulnerabilities to try and hack into websites. So we have governments taking down websites, we have really popular websites that are going down briefly to be able to fix this vulnerability. This is a real reckoning moment, where we’re going to find out the downside risk of building so much of the internet on open source technology like PHP. When you really get down to the bone level of the internet, it is held together with glue and dreams.

Sean O’Kane：本周互联网似乎在很多方面都出现了故障。如果人们对这件事还不太了解，我认为最好的理解方式是：在过去 10 年里，我们有多少次遇到过这样的时刻——某些东西坏了或差点坏了，而某个出于爱好维护着一个小代码库的人，恰好发现了正在发生的恶意行为，从而拯救了互联网基础设施，使其免于彻底崩溃？现在把这个场景放大十亿倍，当人们不仅可以使用每个人都在用的那些极其先进的大型语言模型（LLM）软件，还有能力指派它们去执行任务，创建出专注于完成这些事情的人工智能代理时，情况会怎样？本周我们看到了两件事的平衡。一是像谷歌和 OpenAI 这样的一批实验室和公司确实让人去寻找了一堆漏洞，包括 PHP 的那个漏洞。另一方面，我们也看到有一群人似乎急于利用这些漏洞试图入侵网站。因此，我们看到政府关闭网站，一些非常受欢迎的网站为了修复这个漏洞而短暂下线。这是一个真正的清算时刻，我们将发现将如此多的互联网建立在像 PHP 这样的开源技术之上的下行风险。当你真正深入到互联网的骨干层面时，它确实是靠胶水和梦想维系的。

Anthony Ha: There’s so many things that were striking about this. One of them is the fact that — as I understand it, at least — this is not a new vulnerability. This is a vulnerability that has existed in PHP for decades. And PHP has been used as a programming language to build so much of the web, so this vulnerability has been there for decades, but no one knew about it. What happened is, essentially, that these big AI companies — including Wiz, now owned by Google — they were able to find these vulnerabilities using LLMs. [As noted above, I got this wrong: Human researchers participating in OpenAI and Wiz’s Hack the Planet initiative found the vulnerabilities, though they used AI to exploit the bug.] I guess part of the calculation is, we need to patch this, because if we can find this vulnerability using LLMs, so can other people. But the only way we can get the patch out there is to announce the vulnerability. And so it creates this very panicked situation where [they say]: “Okay, this vulnerability existed for decades. You have to patch right away, and if you can’t patch it right away, just take your website down. It’s that severe a vulnerability.”

Anthony Ha：这件事有很多令人震惊的地方。其中之一是——据我所知——这并不是一个新漏洞。这是一个在 PHP 中存在了几十年的漏洞。PHP 一直被用作构建互联网大部分内容的编程语言，所以这个漏洞存在了几十年，但没人知道。本质上发生的情况是，这些大型人工智能公司——包括现在被谷歌收购的 Wiz——能够利用大语言模型发现这些漏洞。（如上所述，我之前说错了：是参与 OpenAI 和 Wiz 的“Hack the Planet”计划的人类研究人员发现了这些漏洞，尽管他们使用了人工智能来利用该漏洞。）我想其中的部分考量是，我们需要修补它，因为如果我们能用大语言模型发现这个漏洞，其他人也能。但我们发布补丁的唯一方法就是宣布这个漏洞。因此，这造成了一种非常恐慌的局面，他们说：“好吧，这个漏洞已经存在几十年了。你必须立即修补，如果不能立即修补，就直接把网站关掉。这个漏洞就是这么严重。”

Kirsten Korosec: I think that the important thing is, a lot of people don’t even realize that their websites have PHP — which is this, as you mentioned, decades-old open source programming language. For those who don’t know, Hypertext Preprocessor is the official term, [it’s] this really the core ingredient behind content management systems that are used throughout WordPress, Drupal, something like 70% of websites. We’re talking tens of millions of websites. So to me, it’s the scale. It also made me immediately think two things: One, this is just the beginning. What other decades-old bad software is out there that is going to be exploited? And the other one was something that 404 Media, which had a really great breakdown, mentioned, which is link rot. Because a lot of people, companies, governments, maybe that small neighborhood website, they’re shutting these [websites] down. And so we’re going to have so much link rot and also websites that maybe had a little piece of history out there that aren’t gonna be accessible anymore, as opposed to patching it.

Kirsten Korosec：我认为重要的一点是，很多人甚至没有意识到他们的网站使用了 PHP——正如你所提到的，这是一种有几十年历史的开源编程语言。对于那些不知道的人来说，“超文本预处理器”（Hypertext Preprocessor）是它的正式名称，它确实是 WordPress、Drupal 等内容管理系统的核心成分，这些系统支撑着大约 70% 的网站。我们谈论的是数以千万计的网站。所以对我来说，关键在于规模。这也让我立刻想到了两件事：第一，这仅仅是个开始。还有多少存在了几十年的糟糕软件会被利用？第二点是 404 Media 在一篇非常棒的分析中提到的，即“链接失效”（link rot）。因为许多人、公司、政府，或许还有那些小型社区网站，他们正在关闭这些网站。因此，我们将面临大量的链接失效，以及那些可能承载着一小段历史的网站将不再可访问，而不是去修补它们。

Sean: Anthony, I think you made a really good point. I’ve seen a lot of people unhappy with the disclosure rollout here, a bit of the chest beating that OpenAI seems to have done in its post about it. Also, it seems like a couple people got ahead of the embargo of this release, which set off a race among the hacker set. I think it was Cloudflare CEO Matthew Prince [who] already posted about seeing it escalate to millions of attempted hacks of the PHP2Shell. The thing with these vulnerabilities, the way in cybersecurity this typically works is, if you’re you’re stress testing a company’s software, even if it’s a fundamental piece of software that helps run a lot of different computers or parts of the internet or whatever it might be, you can go to that company and and disclose it and it sort of stays within that bubble. But when we’re talking about something that’s as deep as and as fundamental as this, you can’t go around and tell everybody discreetly. I mean, maybe you could, if the AI was advanced enough and you could task a billion

Sean：Anthony，我觉得你提到了一个非常好的观点。我看到很多人对这次漏洞披露的流程感到不满，OpenAI 在其相关文章中似乎表现得有些自吹自擂。此外，似乎有几个人提前泄露了这一消息，这在黑客圈引发了一场竞赛。我想是 Cloudflare 的首席执行官 Matthew Prince 已经发帖称，他看到针对 PHP2Shell 的黑客攻击尝试升级到了数百万次。关于这些漏洞，网络安全领域通常的做法是，如果你在对一家公司的软件进行压力测试，即使它是帮助运行许多不同计算机或互联网部分的基础软件，你也可以直接向该公司披露，这样它就只会留在那个小圈子里。但当我们谈论像这样深层且基础的问题时，你无法私下里去告诉每一个人。我的意思是，如果人工智能足够先进，并且你能指派十亿个任务……