The day the internet nearly crumbled
Last Monday, October 20, a security notification rippled through the technology world with a simple, terrifying ultimatum: update your systems or take your website offline. This was not a drill. It concerned two vulnerabilities discovered in the PHP programming language — a technology decades old that powers roughly 70% of the world's websites. Governments in the Netherlands, Finland, and Belgium, along with the Wikimedia Foundation (operator of Wikipedia), pulled public systems offline as a precautionary measure. What drew particular attention was not just the severity of the flaws, but the context in which they were discovered: human researchers participated in OpenAI and Wiz's (now part of Google) "Hack the Planet" initiative, and used large language models to help exploit the vulnerabilities. The result: millions of attack attempts within hours — Cloudflare CEO Matthew Prince himself estimated the number.
But PHP2Shell is not an isolated case. It is the most visible symptom of a much broader reality: the global infrastructure of the internet is far more fragile than most people imagine, and the rise of artificial intelligence is exponentially accelerating both vulnerability discovery and the attack surface available to those who want to exploit it.
The internet held together by glue and dreams
TechCrunch reporter Sean O'Kane summed up the situation in a phrase that went viral across technology networks: "at our most fundamental level, the internet is held together by glue and dreams." That metaphor captures an uncomfortable reality. Most of the modern web runs on software stacks built in the mid-1990s and early 2000s. PHP, Apache, MySQL, Unix filesystems — they were brilliant technologies for their time, but designed for a radically different internet than what we have today.
The PHP flaw had existed for decades. It was not something new. What changed was the ability to find it. Previously, it required a security researcher with years of specialization, the patience to walk through millions of lines of legacy code, and luck to find the first clue. Now, the same task can be assisted by language models trained on billions of tokens of source code — and executed at a global scale, not only by well-funded research teams but by anyone with access to AI tools.
Kirsten Korosec, also from TechCrunch, pointed out another alarming aspect: the "link rot" problem. When government, corporate, and even community websites are pulled offline preemptively, that content disappears. "Many people don't even know their websites run PHP," she noted. "And when they shut them down, we lose pieces of digital history."
The attack surface explosion
Censys data from the State of the Internet 2026 report offer an even more concerning perspective. In the nine months leading up to the report, publicly exposed AI infrastructure grew 63%, reaching approximately 268,000 systems visible on the internet. The most widely exposed product was n8n, a workflow automation and AI agent platform, with over 113,000 exposed hosts. Of those, 76% were running versions within the range affected by at least one recent critical vulnerability.
Censys observed something particularly unsettling: the most critical AI exposures sit in the least visible layers of infrastructure — the tools that coordinate automated workflows, connect agents, and store credentials for external services. A compromise at that layer could reach well beyond the AI application itself.
This creates a paradox. As companies and governments expand their use of AI, they are simultaneously widening their attack surface. Automation tools meant to increase efficiency become risk vectors when poorly configured or not updated. And, as the PHP2Shell experience demonstrated, vulnerabilities that remain dormant for decades can be suddenly discovered when the computational power needed to find them becomes widely accessible.
Networks unprepared for the AI era
The problem is not just security — it is capacity. Global network infrastructure was designed for predictable traffic: video streaming, cloud migration, SaaS access. AI behaves radically differently.
According to analysis from TechVoices, AI inference places extraordinary strain on network infrastructure, happening billions of times per day when users interact with search, productivity tools, coding assistants, and enterprise applications. When a user sends a prompt, the resulting inference can trigger a cascade of network activity: systems retrieve data, coordinate across clouds and data sources. In many cases, the model's "brain" is effectively scattered across the network.
Network infrastructure is asymmetric by design. Download connections represent about 85% of internet capacity, with upload capturing only 15%. AI flips this dramatically: estimates indicate upload could jump to 35% of total traffic, inverting the traditional model. And the demand keeps growing. Projections forecast up to a 700% increase in traffic by 2034 — and we're already seeing this play out in real time. In some high-demand AI corridors, traffic has grown tenfold in the past 24 months.
The future: more vulnerabilities, more scale
What follows PHP2Shell will likely be the norm, not the exception. Companies like Nvidia are already offering open-source tools for creating automated security layers, while startups specializing in AI security are raising record funding. But the pace of AI infrastructure expansion outstrips the maturation of defenses.
What the PHP2Shell experience teaches us is that fragility is not a system bug — it is a structural characteristic. The internet, built on decades of legacy software maintained by volunteer communities, will face a future where vulnerability discovery is cheap and scalable, but remediation is expensive, slow, and uneven. The infrastructure sustaining our digital civilization is, increasingly, under strain.
Sources: TechCrunch, Axios, TechVoices
✓ Independent sources cross-checked and verified before publishing
