The infrastructure that supports the Internet is aging. That’s natural, but what we couldn’t have predicted just three years ago was that the arrival of sophisticated artificial intelligence (AI) models would drastically accelerate their aging. We have a problem. What happened with the PHP programming language shows that Internet security requires us to maintain and review technologies that have been around for decades and may be more vulnerable today than ever before.
AI is helping us find vulnerabilities that have gone unnoticed for years, but detecting them is not enough; It is also essential to modify them, and this is not easy to do in a large and heterogeneous infrastructure like the Internet. What happened with PHP can help us understand exactly what we are dealing with. This language was conceived for web application development, and is important because it has a central role in the ecosystem of applications and services that use it as part of their infrastructure.
Just because a system works properly for many years does not guarantee that it is error free and secure. Programmers writing their code are often forced to maintain compatibility with applications, libraries, and extensions that depend on their behavior. Fixing a bug in one element of code often requires fixing other parts of the code, which can trigger errors in long-running applications. It’s a complicated scenario, it’s true, but we now have an essential tool to solve this problem: AI.
Maintaining old software is a structural problem
One of the PHP vulnerabilities that triggered this crisis is not new. The foundation that supports the programming language, known as the PHP Foundation, identified it during its security review in 2024, but the engineers who discovered it at the time did not find any known exploits. Additionally, it was difficult to correct, which contributed to the delay in resolution. We now know that it is a mistake not to give such a problem the importance it deserves, especially if it affects an essential component of the Internet.
This complexity has led to digital infrastructures that require us to operate on currently obsolete components.
Outdated software maintenance is a structural problem that doesn’t just affect the Internet; All types of companies also face this. The biggest disadvantage in this scenario is that of frequently updating a technology It is not enough to install a new version; In many organizations, applications rely on specific versions of a language, libraries that are no longer maintained, or operating systems that cannot be replaced without major changes.
Because of this complexity we currently have to work on obsolete components due to the digital infrastructure and the PHP crisis has put on the table the need to replace them. AI is playing a fundamental role in identifying vulnerabilities, but it is also a very valuable resource that can be used to fix them. In fact, Google Cloud described how its engineers used AI models to identify and verify PHP bugs, develop exploit tests, and verify fixes.
AI’s greatest strength in this context is that it allows us to review large amounts of code and identify patterns that are difficult to detect through conventional review. Additionally, it can help engineers identify failures before they are absorbedHowever, the ability to find vulnerabilities does not guarantee that they can be fixed immediately. In any case, the role of people in these situations is going to be crucial as human resources are needed to review and correct vulnerabilities, although our response capacity may become a bottleneck.
Picture | Sergey Starostin
In Xataka | How often we should change all our passwords, according to three cybersecurity experts
