TechCrunch asks whether AI will stress fragile internet infrastructure

TechCrunch published an article on Oct. 24, 2026 asking whether AI adoption will stress or reveal the internet’s fragile, under-maintained infrastructure.

On the TechCrunch Equity podcast, hosts said AI adoption could act as a stress test for internet infrastructure. Sean O’Kane said the internet is “held together by glue and dreams” at its bone level. He called the PHP vulnerability disclosure a real reckoning moment for internet infrastructure built on open source technology.

PHP is a decades-old open source programming language behind content management systems such as WordPress and Drupal, and it powers 70% of websites across tens of millions of sites. Open source means the code is freely available for anyone to use and modify. Kirsten Korosec said Hypertext Preprocessor is the official term for PHP, providing the formal expansion of the acronym for readers. Many website owners do not realize their sites run PHP.

Anthony Ha said the PHP vulnerability is not new, noting it has existed in PHP for decades. He said PHP built so much of the web, the vulnerability existed for decades, but no one knew about it, tying the broad use of PHP to the long undiscovered flaw.

Anthony Ha initially said big AI companies including Wiz, now owned by Google, found the PHP flaws using LLMs, then retracted that attribution in favor of a specific research initiative. LLMs, or large language models, are AI systems that generate text and code. Researchers tied to OpenAI and Wiz’s Hack the Planet project found the PHP vulnerabilities, and AI exploited the flaw.

AI agents and large language models make finding internet vulnerabilities easier, but human researchers, not AI models, found the specific PHP flaws. AI agents are programs that pursue a goal automatically with limited human input. Google and OpenAI sent people to find vulnerabilities including the PHP flaw while others hurried to exploit them and hack websites.

Cloudflare CEO Matthew Prince posted that attempts to exploit PHP2Shell had escalated to millions of attempted hacks. PHP2Shell is the name given to the exploit. Kirsten Korosec said Matthew Prince’s social media post was really telling and pretty scary. Kirsten Korosec said Amazon put out a blog post, noting Amazon published its own post about the issue.

Amazon operates a honeypot, a decoy network designed to attract and observe attacks, and observed exploit attempts against the PHP vulnerability before its public announcement. Kirsten Korosec said Amazon has the tools, capital and know-how to fight such threats unlike many websites and government sites.

She contrasted well-resourced firms with under-resourced sites and government, saying so many websites and even potentially government websites lack Amazon’s level of attention, which is really the scary part. Governments took websites down, and popular websites went offline briefly to fix the PHP vulnerability.

Earlier this week, an announcement told PHP site owners to patch right away or take their sites down if they could not update immediately. The announcement framed the flaw as severe enough that taking a site offline was the safe alternative to a fast patch.

Critics faulted the disclosure rollout, citing OpenAI chest beating and parties that got ahead of the embargo, which triggered a race among hackers. An embargo is an agreement to withhold publication until a set time. Anthony Ha said part of the calculation is patching because if they can find the flaw using LLMs, other people can too, framing disclosure as necessary because LLM-based discovery is not exclusive.

Anthony Ha said the only way to get the patch out is to announce the flaw, creating panic requiring immediate patching or taking the site down. Sean O’Kane said discreet disclosure is not possible for fundamental internet software because there is no simple way to reach every person who controls part of a website.

He said typically when stress testing a company’s software you disclose it to the company, and it stays within that bubble. He contrasted normal contained disclosure with the difficulty of broad disclosure. Sean O’Kane said maybe if AI becomes advanced enough you could task a billion agents to e-mail everyone who controls part of a website, and he floated AI agents as a theoretical way to reach every site controller.

Sean O’Kane said we are rueing the days when webmasters were readily identifiable, which might have solved the problem to some extent, lamenting the loss of identifiable webmasters as a disclosure aid. On this week’s TechCrunch Equity podcast, Kirsten Korosec, Sean O’Kane and Anthony Ha discussed the PHP-ocalypse and whether more such incidents will happen; the preview framed the conversation around whether AI-driven vulnerability discovery will produce repeat events.

Sean O’Kane said a lot is breaking across the internet this week, and he opened his segment by characterizing the current week as one in which the internet is breaking in many ways. Sean O’Kane said that over the last 10 years a hobbyist running a small code repository caught something harmful and helped save internet infrastructure from collapse, describing individual hobbyist maintainers as the catchers of nefarious activity that could otherwise crumble the internet. A repro repository is a small code sample used to reproduce a bug.

Sean O’Kane said to multiply that by a billion when people can task AI agents that are single-minded at accomplishing those things, arguing AI agents operated at scale would vastly increase the volume of such threats. Kirsten Korosec compared the threat to prepper doom, citing possible bank exploitation and data and privacy concerns that feel too large to fix.

The TechCrunch article said AI employees could push exploitation to a next level of prepper doom with banks among possible targets and serious data and privacy concerns. Kirsten Korosec cited 404 Media on link rot, saying people, companies, governments and small neighborhood sites are shutting down instead of patching, and she warned that shutdowns create link rot and erase small pieces of online history. Link rot refers to links that no longer work because the pages they point to have been removed.

A 404 Media breakdown connected the shutdown response to link rot, removing websites and pieces of online history from access. Kirsten Korosec said this is just the beginning and asked what other decades-old bad software attackers will exploit, framing the PHP case as the start of a wider problem with aging software.

Sean O’Kane said this is the beginning of a lot of back and forth, characterizing the episode as the start of a new cybersecurity era. Kirsten Korosec said she wants to see how extreme people’s behavior gets, and she said she will watch for extreme reactions to the disclosure.

The situation may produce new security startups or drive adoption of open source security tools from companies such as Nvidia. AI-assisted vulnerability discovery could increase pressure on aging, under-maintained internet infrastructure such as open source components like PHP, according to TechCrunch reporting.