The Vulnerability Apocalypse and Why We Should Fund Open Source

On a recent Tuesday, an alarming number of websites experienced sudden downtime while tech enthusiasts discussed the ongoing "Vulnerability Apocalypse" and the programming language PHP, which powers nearly 70% of all websites worldwide. This incident has sparked questions about the nature of this event, the role of PHP, and what individuals can do to protect themselves. To learn more, readers are directed to the first blog post in this series.

PHP, a programming language primarily used to create interactive websites, is employed by major sites such as Facebook, Wordpress, Wikipedia, and Etsy. It is a well-established component of web development, but its open-source nature means that maintenance of these crucial systems relies on a limited number of dedicated volunteers who work on it in their spare time.

The current crisis exemplifies the need for increased funding and support for open-source projects. Corporations should also contribute financially and in kind. Common Vulnerabilities and Exposures (CVEs) are used by security professionals to document software vulnerabilities, with the National Vulnerability Database (NVD) serving as the official repository for CVE reports.

In the month of October alone, 13,000 new CVEs were submitted, indicating that 3% of all recorded security bugs have been discovered in the past month, with projections suggesting that over a quarter of all software vulnerabilities ever identified will be from 2026.

The rise in vulnerabilities is attributed to advanced AI models from companies like Anthropic, OpenAI, and Google, which have made it easier and more cost-effective for individuals with moderate technical skills and access to these models to discover vulnerabilities. For instance, PHP vulnerabilities were reportedly identified using a simple AI-driven prompt.

In 2024, a potentially serious PHP vulnerability was initially overlooked due to disagreement among maintainers and insufficient exploitation attempts. However, in August 2026, two independent researchers, utilizing advanced AI models, rediscovered the vulnerabilities and developed exploits. The severity of these flaws is alarming, as they would enable hackers to gain unauthorized access to websites running PHP, leading to data theft, malware distribution, user surveillance, system shutdowns, and large-scale denial-of-service attacks.

Despite the severity of these vulnerabilities, a coordinated effort between researchers and PHP developers led to patches and a planned disclosure. However, news of the vulnerabilities leaked on October 20th, causing companies to scramble to apply patches before exploitation became widespread. As of the writing, over 33 million websites are still using vulnerable versions of PHP.

The internet infrastructure heavily relies on open-source software, which is predominantly maintained by a small group of skilled volunteers often supported by modest stipends, rather than by large corporations. When vulnerabilities are discovered in these projects, the consequences can be devastating. Other widely used open-source projects, such as Node.js and GitLab, have also been identified as having critical security flaws.

The open-source community is currently experiencing unprecedented levels of burnout, with maintainers overwhelmed by a deluge of vulnerability reports. This situation underscores the urgent need for stronger support for open-source projects, which have been instrumental in building the modern, multibillion-dollar internet industry.