If you spent much time online this week, you likely noticed how it briefly felt like the end of days as government websites, game marketplaces, and furry image boards alike were pulled offline in a scramble to address newly-discovered security vulnerabilities in PHP—a scripting language used by roughly 70% of the world's websites, according to some estimates.
It was a harrowing incident, revealing flaws in foundational internet infrastructure that might have turned some of the most popular web destinations into attack vectors. And in an interview with Reuters, Cloudflare CEO Matthew Prince says we should expect to see similar episodes on a regular basis in the years ahead as LLM technologies accelerate the discovery of exploitable security vulnerabilities.
Prince said that Cloudflare—a major cloud networking and cybersecurity provider that a massive number of websites relies on—is aware of "a bunch of additional severe vulnerabilities that are present in other pieces of critical software" like those that triggered the PHP panic earlier this week. And as both cybersecurity experts and bad actors task LLMs with identifying previously unrecognized weaknesses in the core technologies of the internet, there will likely be more to follow.
"I think we're going to have a couple years where every single week it's going to feel like the sky is falling," Prince said.
Previously, the rate at which exploitable flaws in software could be identified was limited by the finite number of experts able and willing to devote the necessary time and attention. Likewise for those seeking to weaponize those flaws.
For a user directing a workforce of LLM agents, however, those limitations are less relevant. Wiz Research, one of the firms that identified the recent PHP exploits with the assistance of LLM tools, wrote in a blog detailing its findings that "the economics of both discovery and exploitation" have changed.
"Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours," Wiz Research said. "As the time and expertise required for this work decrease, complexity may no longer provide a meaningful barrier, changing how we define what is vulnerable in practice."
But while Prince expects busy months ahead for those whose job it is to address the rising tide of LLM-empowered exploits, he said it will—in the long term—lead to more secure software as those newly-identified vulnerabilities are patched.
"The reality is, we're going to get a lot of this stuff cleaned up," he said.
In the short term, however, my advice is to stay on top of your browser and app updates. In the years ahead, some extra paranoia won't hurt.
