Consider, for a moment, the unseen plumbing of the modern world. We rarely contemplate the municipal water pipes until water runs brown from the kitchen tap, nor do we pay much mind to the asphalt beneath our tires until a pothole swallows a rim. For three decades, the digital equivalent of that unglamorous concrete has been PHP, an open-source scripting language conceived in the mid-1990s that quietly underpins roughly seven out of every ten websites on earth. It powers neighborhood bakery storefronts, school district announcement boards, local newsrooms, and vast swaths of Wikipedia. It is not sleek, it is not venture-backed, but it works, held together largely by the quiet, thankless labor of a global open-source community.
That delicate equilibrium shattered this week. Security researchers and state-sponsored actors alike are reckoning with a wave of severe vulnerabilities unearthed not by painstaking human audits, but by artificial intelligence. Automated models, trained on millions of lines of code, have begun scouring the digital public commons with terrifying efficiency, discovering systemic weaknesses that had remained hidden in plain sight for decades. Almost immediately, exploitation attempts surged across the globe, sending cybersecurity agencies from Washington to Brussels into an emergency posture.
It is a development that Silicon Valley’s cheerleaders will no doubt frame as an inevitable triumph of machine intelligence. In corporate keynotes, the ability of AI to parse millions of lines of legacy software is routinely heralded as the dawn of automated defense, a shining example of technology healing its own wounds. But that glossy narrative ignores the profound asymmetry at the heart of our digital architecture. Finding a structural flaw with an algorithmic sweep takes seconds; repairing it across millions of independently hosted, under-funded websites takes months, if not years.
The resulting scramble reveals the deep moral hazard baked into our current technological moment. The tech conglomerates pouring billions into developing powerful generative models operate at lightspeed, incentivized by market share and prestige. Meanwhile, the actual maintenance of the internet’s core infrastructure remains stubbornly human, under-resourced, and reliant on civic goodwill. When an autonomous system shakes loose a structural beam, the venture funds do not show up to shore up the foundation. The burden falls squarely on overworked municipal IT directors, community webmasters, and open-source volunteers who are expected to pull sleepless nights to keep the lights on.
There is also something deeply disquieting about the democratic cost of this exposure. When severe vulnerabilities cascade through a language as ubiquitous as PHP, the casualties are rarely the Silicon Valley titans who have walled gardens and private server farms staffed by armies of engineers. Instead, the damage radiates outward into civic life. It threatens the small independent publisher, the municipal water authority’s payment portal, and the non-profit clinic managing patient records on a modest WordPress installation. In their rush to build increasingly capable diagnostic engines, the architects of AI have effectively handed a digital battering ram to bad actors while leaving the public sphere to defend itself with paper shields.
What we are witnessing is not merely a technical crisis, but an institutional failure of public investment. We have allowed the digital commons—the shared spaces where civil society actually lives—to depend on legacy tools that the private sector exploits for value without ever adequately funding their upkeep. If governments wish to do more than simply issue panicked bulletins after the alarms sound, they must treat software infrastructure with the same solemnity they afford bridges and power grids. That means direct, public funding for open-source maintenance, and holding the creators of destabilizing technologies accountable for the collateral damage their products leave in their wake.
Until that reckoning arrives, we are left with a sobering glimpse of the future we are actively constructing. It is an internet where automated intelligences can systematically dismantle the fragile agreements that hold civil society together, moving far faster than human institutions can reasonably respond. We are modernizing the wrecking balls while leaving the caretakers to work by candlelight.