Advanced AI found a decades-old, massive hole in the internet, but instead of gratitude, people are once again screaming “death to AI”, finds Satyen K. Bordoloi.
In 69 BC, as the Roman general Lucullus advanced into Armenia, a messenger informed King Tigranes the Great. But Tigranes beheaded the man. Plutarch recorded the episode as a cautionary tale about pride and power because after that, no one dared bring the king bad news, leaving him blind to the threat gathering around him. This won’t be the only case of “shooting the messenger”, as the expression would even enter the age of AI.
That became the catchphrase once again in October as an AI-assisted security review uncovered two critical flaws in PHP – the half-a-century-old scripting language that still quietly runs about 70 per cent of the web. The flaws were real, bad enough to cause serious harm to those who know how to exploit them and, ironically, had been sitting in the foundation of the internet for at least a decade. Isn’t this cause to thank AI for once? Nope, because it turns out that almost immediately, a gaggle of voices screamed the same doom-song about AI destroying the world, even calling the month “Black October”
It seemed the logic for the doomers was simple: AI found a flaw that could let attackers read memory, steal passwords and even take down government or banking websites. And indeed, as we have covered in Sify, the attacks on websites, almost in every country in the world, have escalated after this vulnerability became known. The doomers are calling this AI handing hackers keys to the internet; i.e. AI is evil.
Irony has rarely died a more painful death.
THE GAPING HOLE IN SECURITY
Let me draw you a simple analogy to try and explain this. You spend years and a small fortune building high fences around your house and installing cameras all around to protect it. You feel safe for years. Except one day someone walks up to you and says that there is a gap behind the hedge, a hole so wide that anyone could walk through it and rob you blind. What do you do in this case? Do you call the man a thief or thank him, no matter how begrudgingly, and quickly begin fixing that gap?
That is essentially what happened with PHP. The vulnerability was not created by AI. It always existed and lay hidden for so long because the unstated rule of the software industry is: if it works, don’t touch it. And it did work for over a decade. But that is only because no one noticed till AI did. So is AI the villain, or the hero of the story for saving the internet by finding one of its biggest flaws?
Yet, bizarrely, the doomers have seized on this as proof of AI’s menace, many taking an I-told-you-so victory lap full of glee as website attacks exploded exponentially, even as analysts throw phrases like “vulnerability tsunami” and “harbinger of things to come” because who knows what other flaws AI might find.
That is true. AI might indeed find a ton of other flaws in the internet and other systems. And that is not a bad thing; it is the best possible thing: find the gaps and patch them before bad actors do.
THE IRONY OF IT ALL
Here’s an important detail, once again, that gets lost in the melee: the PHP flaws were not created by a rogue AI, but found by a human security researcher using AI tools. According to some accounts, the AI’s role in it was overstated. What the AI did, in essence, was act like a magnifying lens, allowing researchers to scan millions of lines of legacy code and spot patterns humans would have taken years to find. This is an act of benevolence.
But the doomer narrative requires AI to be the villain, even when AI is doing the job that the industry should have done years, or decades ago. Instead of pointing the finger at those who had ignored PHP’s foundation because “it was working”, they’re pointing it at AI because it pointed out the flaws.
That is what I have often argued: the problem is rarely the tool we use, in this case, AI. It is the fog created with imagined narratives that obscure the truth before us. When we say “Artificial Intelligence”, we immediately imagine HAL 9000 or the Terminator, or Agents from The Matrix, when what we actually have under those two words are systems that have a very fast pattern-recognition engine that is good at finding things humans are too tired, too overworked, or too budget-constrained to look for. This discovery of the PHP bug is not a sign that AI is becoming malevolent, but is proof that AI is being useful in exactly the unglamorous, unsexy, and mundane ways that actually matter: auditing code, finding bugs and by doing that forcing the industry to fix that which it has spent decades ignoring.
THE REAL REASON FOR THE PANIC
The PHP vulnerability is not the complete story, and to get into the subconscious of the world, we’ll have to wear a Sherlockian hat over Freudian spectacles. The panic is truly about the loss of control: the sudden realisation that the foundation, the basic architecture of the internet, of the software around us, is not so secure after all. That they are held together by a terrible glue and work only because bad actors have not gone after it. AI did not create this fragility but simply made it visible at a speed that feels like an attack: this view by some commentator I read is spot on.
Because consider the alternative. That AI did not find the bug, but years from now some humans wanting to hack and crack did. What would such a malevolent group unleash on the world with such a foundational vulnerability? We can’t even imagine the answer. Because we don’t need to. The meteor of extinction just missed us, even as the debris from its tail continues to rain down on the world and cause some damage.
The doomers will not see it this way because their framework does not allow for such near misses. They only see the exposure and the world scrambling for an answer even as hackers attack, as proof of AI’s direct or tacit malevolence. The result is exactly what King Tigranes did: he eventually lost not because the messenger was wrong, but because he had beheaded him, ensuring no one else would tell him the truth.
This is 2026. And we cannot let the followers of Tigranes win, no matter how appealing terms like “Black October” sound to us. The messenger should not be shot. It should be cherished.
In case you missed:
- Anthropic was afraid of their latest AI Mythos: they released it anyway, to the panic of the world
- For AI, Your Selfie Is a Medical Scan; But It’s Not All Rosy
- The Machine Made Me Do It: Inside the Global Rise of ‘AI Psychosis’
- $725 Billion Down, Trillions To Go: Why The AI Bubble Refuses To Burst
- Research finds AI ‘scheming’ is increasing; Is it, and will it destroy the world?
- Pope Leo’s surprising AI awareness, and what it says about our world
- The Net That Caught Itself: How the World Learned to Cage the Internet
- What The First Fully AI Film To Enter A Major Festival Says About AI Filmmaking’s Future
- AI Browser or Trojan Horse: A Deep-Dive Into the New Browser Wars
- Anthropic Accuses Chinese AI of “Stealing”, Internet Points Finger Back At Them
