The Hackening

Last week at a small conference, there was talk about a future event referred to as The Hackening. As in, within 6-12 months, many predicted that due to advanced AIs and AI agents the internet would become a severely hostile place. Some worried that this could rise to the level of ‘assume any phone connected to the internet is rooted’ and several people urged doing general crisis preparations on a personal level, in case of disruptions in supply lines, power, water or internet.

It did not take long for things to escalate.

The biggest hack is a flaw in PHP, which can be exploited to take control of the computer running any website using an unpatched version of PHP. There are many others.

On a personal level, you want to do at least some basic prep and get your security in order. It is cheap to do as a form of insurance, and being caught not having it when you need it is a large mistake. That doesn’t mean you should panic, or cancel travel plans or anything like that. But there is low hanging security fruit out there. Pick it.

And So It Begins: PHP

Joshua Achiam (Formerly OpenAI): Feels like March 1, 2020 for Cyber. Not normal, something is happening. Internet lockdowns in a couple of months?

Multiple sources using GPT-5.6 Sol identified a critical flaw in PHP. Okay, identified two critical flaws in PHP. The plan was to deploy the patch first before announcing the flaw, but the embargo on the fix got broken more than six hours in advance, so here we are.

Dan Lorenc: I wanted to share what happened with the PHP embargo, our role in it, and my decision process last night to ship the fixed builds early. First of all, the PHP Foundation and maintainers did an amazing job here in a high stress situation. I'm sorry that my decision led to even more stress for them.

We first got read in that there was something coming up in PHP last Friday by one of the original researchers that discovered this issue. That night we were able to independently discover the same issue using our harness and a frontier model with a basic prompt of "find bad vulnerabilities in PHP".

We got fully read in Saturday and confirmed that some our findings matched those from the initial report, and worked to help test the fixes.​

They may have been in a rush due to attackers finding the exploit. Amazon reports that this was happening as early as October 17, four days before disclosure. We are fortunate that this did not scale far larger than it did. [...]

Jonny G: Can somebody explain this to me like I’m 5 years old please? Ta.

BRYNMAWR ∴ SHERLOCK: Websites are files on a computer. When you view a website, you are asking the computer to send you the files, then your browser shows them to you.

70% of the websites you see use PHP to make them interactive. So you can send things to the website too and it can respond. E.g. filling in a comment box and hitting ‘post’ adds the comment as a row to a spreadsheet.

PHP has a flaw in its code that allows anyone to gain control of the computer that has the website on it.

The organisation that provides PHP announced the vulnerability before a patch was available, meaning we’re in a window where everyone knows about it (including baddies) but the good guys don’t have an official solution.

Some are just turning off their websites and waiting for the solution. Others are trying to fix it themselves. General chaos and lots of stressed techies across literally the entire planet because this affects the entire internet.

The bug has been there for 14 years and was discovered in 2024, but it was not considered significant at the time. A lot more bugs are significant now.

The PHP Bug Was Kind of a Big Deal

Things could have gone very, very badly, the same way Y2K could have gone quite badly if we had not done the work to prevent it. These days we are on rather tighter deadlines.

Internet Archive: https://Archive.org is currently offline. We are working to restore service now.

Brewster Kahle (21 hours later): Internet Archive ops staff were heroes last night.

PHP vulnerability announced, soon saw attacks, isolated the vulnerability, used Claude to make fixes for our older php versions, used local models to run simulated attacks, deployed.

In summary:

j🫪e: ICYMI: Today was basically the worst day of the year for cyber security incidents

On Your Marks

Now the race is on to patch all the systems before attackers can go on the offensive. OpenAI is helping race to get that done to the greatest extent possible, and are looking for better methods for fixing vulnerabilities in time.

John David Pressman: I know everyone is rightfully freaking out but it must be noted that the worst case scenario isn’t you receiving lots of patches you have to apply, the worst case scenario is receiving zero patches and waking up to everything having been stolen.

John David Pressman: My takeaway so far is that we do not have a good way to coordinate the distribution of patches to vulnerable software.

This one was important enough the NSA got in on the act.

NSA Cyber: Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server’s file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.

We are going to need better procedures for updates.

The best case scenario is that a defender finds the bug first, has enough time to figure out a solution and creates a patch. Then, the moment the patch is rolled out, every attacker gets what are effectively very clear instructions on how to exploit any unpatched systems.

by Zvi Mowshowitz, DWAV |  Read more:

Image: The Simpsons; uncredited

[ed. So far, zero coverage in the mainstream media. See also: If the vulnpocalypse is the apocalypse, where are the agentic attacker hordes? (Joshua Saxe):]

*****

We’ve ignored how cybercriminals are unskilled and get arrested a lot

Here’s the first part of my theory: cybercriminals are not the organized geniuses we implicitly imagine. Anyone building a criminal gang has to find candidates willing to forgo more stable opportunities in the formal economy. My modeling estimated that something like 720,000 people are involved in the online criminal economy, 90% of them in scam and fraud call-center type operations, some of them human-trafficked. Of the 76k or so actual hackers, the vast majority work for governments. Of the remaining few thousand criminal hackers, most work in ransomware.