AI Finds the Cracks the Internet Has Been Ignoring

The old internet is facing an automated audit. Companies and government agencies rushed this week to patch two critical flaws in PHP, the open-source programming language behind something like 70% of websites. Website owners were told to patch immediately—or take their sites down if they could not update.

The vulnerabilities became known as PHP2Shell, and the episode shows how AI tools can find software flaws at speed and scale. OpenAI said its agents helped detect severe vulnerabilities, but a correction matters: human researchers taking part in OpenAI and Wiz’s Hack the Planet initiative found the flaws, then used AI to exploit the bug.

That distinction does not make the situation comforting. PHP has existed for decades, sits beneath content management systems used throughout WordPress and Drupal, and touches tens of millions of websites. Plenty of owners may not even realize their sites use it—Hypertext Preprocessor is not exactly a name designed for casual recognition.

PHP exposed the cost of old software

On TechCrunch’s Equity podcast, Kirsten Korosec, Sean O’Kane, and Anthony Ha discussed what Sean called “a real reckoning moment.” He said that when you get down to the bone level of the internet, everything seems to be “held together by glue and dreams.” The internet, he added, is breaking in lots of ways this week.

People rushed to exploit the flaws, governments took websites down, and popular sites went offline briefly for repairs. Cloudflare CEO Matthew Prince posted about millions of attempted hacks of PHP2Shell, a development Kirsten called “pretty scary.” Amazon also saw exploitation attempts before the vulnerability had been publicly announced through its honeypot network, a decoy system designed to attract attackers.

The disruption may outlast the patch cycle. Kirsten pointed to link rot and warned that companies, governments, and small neighborhood websites could shut down, taking pieces of history with them. She wondered whether this marks the “next level of prepper doom,” especially as banks, data, and privacy face the same aging infrastructure problem.

Michael Daniel, president of the Cyber Threat Alliance and a former White House cybersecurity coordinator under Barack Obama, described the larger shift in blunt terms: “This is the beginning of a pretty chaotic period, given the abilities of the advanced models.” He has argued for years that AI systems finding vulnerabilities at speed and scale will produce “a flood of these vulnerabilities.”

Daniel calls it “our tech debt coming due.” Software incentives have favored keeping systems alive as long as possible, while organizations failed to count the security risk as a direct cost. That cost stayed implicit until a vulnerability turned maintenance into an emergency.

The response will require more than downloading patches. Organizations need to keep software updated and implement fixes when they arrive, while smaller organizations must shift their operations to accept vendor updates as fast as possible. Daniel expects a flood of vulnerabilities, patches, and mitigations—and not all of them will be created equal.

The pressure comes from both sides. Historically, only five or six percent of vulnerabilities were exploited, and Daniel said there is no indication that rate is rising; attackers can now move much faster when they do act. A proof of concept once took a month or two to appear, followed by another month or two before exploit kits carried it. Now the timeline is hours or days.

Businesses used to test patches exhaustively because breaking production felt unacceptable. They no longer have that luxury: a one percent chance of breaking something may look preferable when an attack could cost 50 million dollars. The hard part is separating real danger from noise—Daniel called the PHP case a prime example of a real threat while urging organizations to improve their triage systems.

Kimi K3.1 Pro joins the same new reality

The Interconnects podcast’s episode #20, dated Oct 25, 2026, places that cyber discussion beside another sign of AI acceleration. Nathan Lambert and Florian Brand discuss Kimi K3.1 Pro, PHP2Shell, LiteLLM, “the new internet,” abliterated APIs, safeguards, trusted access, Anthropic not hiring juniors employees, and Florian’s Muse addiction. The episode includes “Kimi K3.1 Reaction” and “Wrap-up” chapters, because apparently one technological upheaval needs several plotlines.

Chinese AI startup Moonshot unveiled Kimi K3.1 Pro on Friday as a 3-trillion parameter post-trained successor to Kimi K3, released back in July. Moonshot and Artificial Analysis say it scores high on third-party benchmarks, and Artificial Analysis places it above Xiaomi’s MiMo-V2.6-Pro, DeepSeek V4.1-Flash-1017, Meta’s Muse Wonder, and OpenAI’s GPT-6 Astra on its Intelligence Index.

Developers and users can access Kimi K3.1 Pro through its applications and developer API. Moonshot says the weights will be released under an open license on November 4, 2026, a week and a half after the announcement. Published USD rates checked October 24, 2026 list the standard version at $2 per million input tokens, $10 per million output tokens, and $0.20 per million cached-input tokens; the Highspeed version costs $4 for input and $20 for output.

DeepSeek and Xiaomi remain cheaper, but Kimi is priced at half the rates of Claude Opus 5.5 and Meta’s Muse Wonder for input and output. Kimi has also become the subject of an alleged paid influencer scandal on X, which is one way to add human chaos to a machine benchmark race.

Moonshot pitches Kimi as more than a chatbot. Its coding showcase identifies Unreal Engine alongside Unity and Godot, while the company says Kimi can combine game-engine work with web research and 3D generation to produce complete interactive experiences. It can turn a written brief, sketch, or reference image into a model, then modify geometry, materials, and scene arrangements through Blender or CAD scripts without MCP connectors for those scripted operations.

Its 3D Make application lets users inspect and edit models online, download them for 3D printing, or export videos and Live Photos. Moonshot also describes spreadsheet modeling, investment screening, profitability analysis, and research that traces conclusions back to evidence; internal tests report gains of 7.2 points in financial modeling, 11.6 points in research, and approximately 4.2 times Kimi K3’s score in a simulated business-management exercise.

Daniel expects AI tools to examine software before deployment in two or three years, which could produce systems with fewer flaws from the start. That may burn out the old growth and make room for something more secure, but it will not solve cybersecurity. It changes the nature of the problem—and gives everyone less time to pretend the old software is fine.

Stay connected via Google News

Follow us for the latest AI News