AI discovered a vulnerability in part of the internet’s architecture, called PHP2SHELL. Security researchers rushed to fix it, but news of the vulnerability leaked and hackers have swooped in.
Transcript
SCOTT SIMON, HOST: Internet security researchers made a startling discovery a couple of months ago – a vulnerability in the code that most internet servers use. They tried to keep it secret and sprinted to fix it, but they couldn’t stop the chaos that spread across the internet the past couple of days. Kevin Roose co-hosts a new podcast from NPR called Machine Gods, and he joins us right now. Kevin, thanks so much for being with us.KEVIN ROOSE, BYLINE: Thanks for having me, Scott.SIMON: What’s happened?ROOSE: Well, we found out this week that there was a big bug in a very important piece of decades-old software called PHP. Now, for nontechnical people, PHP runs on something like 70% of the websites on the internet. And this week we learned it had two flaws that would let someone take over any computer that was running a website without a password and without leaving any fingerprints. So basically, imagine that 70% of the doors in the world ran on the same locks, and then we figured out that there was a way to pry open that lock and get in. And we need a bunch of new locks for a bunch of doors.SIMON: And as I understand it, researchers used AI to discover this hole?ROOSE: They did, yes. Researchers used AI to discover this hole. The issue is that you need to now patch all of the systems that are running PHP, maybe on an older version, because now we also have these AI tools that can quickly exploit vulnerabilities like this. So there’s a little bit of a cat-and-mouse game going on. Defenders try to patch the systems before the offenders can get in.SIMON: So it sounds like you have two or maybe more rivalrous groups, all of them using AI, half of them to cause problems, half of them to solve them.ROOSE: Yeah. I hope it’s something like only, you know, half and half. But what we’re seeing now…SIMON: (Laughter).ROOSE: …Is a much bigger problem because it is not just PHP.SIMON: Yeah.ROOSE: These AI tools have gotten so good at coding that they have also gotten very good at finding the flaws and bugs in code, and there are a lot of those bugs out there. So some researchers are calling this Black October because there have been so many major incidents – cybersecurity threats – just in the last couple of weeks because of these AI tools and what they allow us to discover.SIMON: And what kind of cybersecurity threats?ROOSE: They’re finding vulnerabilities and exploitable holes in very core pieces of software, pieces of software that people have been using for decades – things like bank systems, things like Node.js, Plex. I mean, I could go on. But basically, these are sort of the big sort of pieces of infrastructure that underlie most of the modern world. And researchers who study these systems are finding a record number of flaws just in the last few months because these AI systems are now able to go out and just be very persistent and try and try and try different ways of picking these digital locks until they find the way in.SIMON: Sounds like it’s only going to get worse.ROOSE: Well, the good news is that over the long term, it may get better. We may have much more secure systems once all these bugs have been fixed. Like, people I talk to in the security industry say they expect that for the next year or two, every week is going to feel like a new crisis as these AI tools crawl over more of the internet and try to figure out what’s broken or missing or open.SIMON: What can be done?ROOSE: Well, for individuals, I think now is a great time to check up on your own security, to change your passwords if you haven’t rotated them in a while, to use a password manager. Take more precautions with things like using unique passwords and updating the software that runs on your devices. I don’t think it’s time to panic for most people, but if you run a small website or your organization hasn’t checked in on its security in a while, this would be a really good time to do that.There are going to be a lot of new pieces of software patches and fixes to these vulnerabilities that need to get installed very quickly. This is crunch time for people who worry about cybersecurity. And this is something that I think a lot of people in the AI industry have been expecting to happen, but maybe not this quickly.SIMON: Kevin Roose is co-host of a new podcast about AI called Machine Gods. Kevin, thanks so much for joining us.ROOSE: Thanks for having me.SIMON: And Machine Gods is available now wherever you get your podcasts.
Copyright © 2026 NPR. All rights reserved. Visit our website terms of use and permissions pages at www.npr.org for further information.
Accuracy and availability of NPR transcripts may vary. Transcript text may be revised to correct errors or match updates to audio. Audio on npr.org may be edited after its original broadcast or publication. The authoritative record of NPR’s programming is the audio record.
Click Here For The Original Source.
——————————————————–
