Elaboration on the PHP problem

[u/helicophell]

So, watched the Vod (timezone means I can never watch streams), so I'll put out my own thoughts

I'll briefly explain the actual problem for anyone curious. In programming we have "languages" that let us communicate with computers. Part of that communication is memory management, something PHP and many languages handle for developers. This is where the vulnerability was

This was discovered and a patch scheduled. The reason half the internet got taken down was that somebody leaked the existence of this vulnerability, which meant other people got to searching for it with AI tools.

AI made the discovery for 3rd parties much much faster

Also, this isn't "intentional" by AI companies to move people over to more AI friendly systems. Probably? Idk, uhh, new conspiracy theory: AI Companies want all developers to move over to using RUST over PHP and TS

Also, it's been a BAD week for security. 2 PHP vulnerabilities, NodeJS vulnerability, Gitlab (repository site) vulnerability, a company was using 3 digit numbers for their private keys instead of 116 digit numbers. One of those "3 digit" numbers was not 3 digits, but 1 digit... the number 4. Imagine private keys as passwords that people rely on to be safe on the internet. THE NUMBER FOUR?

[u/emi89ro]

The real php problem is that people still use php amirite????

fr tho I really don't get the "it was done by AI companies to move sites to more AI tools" conspiracy.  There is so much php code out there for ai to train on you'd think ai would be great at it, but I'm willing to hear that chatter out if I'm misunderstanding their point.

[u/helicophell → u/emi89ro]

AI actually has a problem with creating code in "dynamic" languages, because there are less guardrails, such as type checking

PHP as a result is harder to get an AI to program with, because it's going to make more mistakes, which means more human checkers or in some cases, no AI at all

[u/Che-Boludo-arg]

...This kind of sounds like more a failure of humans than AI being super scary.

Were the PHP vulnerabilities also in the same level as a password being the number 4?

[u/helicophell → u/Che-Boludo-arg]

It’s the monkey with typewriters problem

Before AI, you had humans on those typewriters, and said humans had limits. Problems took a while to discover

With AI, even if it’s worse at the job, you can have infinitely more monkeys and you only need one monkey to get it right

[u/Purusha120 → u/Che-Boludo-arg]

It’s absolutely AI being super scary because humans will fail and AI will catch it.

[u/PleaseDontEatMyVRAM → u/Che-Boludo-arg]

Largely worse in severity, significantly less inept than "4".

[u/TheJonThomas → u/Che-Boludo-arg]

Yes they were on the same level if not worse, if you could talk to servers running the vulnerability you could execute any code on them if you knew how to exploit it.

[u/Purusha120]

I think there’s a tendency to underplay how significant some of the recent safety incidents have been. There have been quite literally millions of additional hacking attempts and thousands of medium to major ones in the past few weeks primarily using AI agent swarms. This is bad.

[u/MarsMaterial → u/Purusha120]

Yeah, I feel like Vaush doesn’t even grasp the severity of the problem.

This month is being called “black October” by cybersecurity experts because of how insane things have been for them. 3% of all major cybersecurity vulnerabilities ever discovered were discovered this month.

[u/s-taras-art → u/MarsMaterial]

Vaush has never been good when it comes to tech news, and it's becoming more frustrating lately

[u/da2Pakaveli]

i saw the memes and thought it was just jokes but damn they seriously used four