Bad AI agents can take down unpatched PHP sites in minutes, developer warns
saibharadwaj · x · 2026-10-23
Developer Sai Bharadwaj warns that malicious AI agents can compromise outdated, unprotected PHP websites within minutes, while well-behaved agents might take years to fix them and still fail. He notes roughly 90% of Indian websites are outdated, especially at the state level, and calls on IT minister Ashwini Vaishnaw to pay attention to the ongoing "bad bot takeover."
The quoted alert reports that PHP, which powers 69% of all websites, had two vulnerabilities rated 9.2 out of 10; the US, UK and Japan told site owners to patch or go offline, four days after hackers had already begun probing the flaw. Japan's prime minister posted the request late at night, the finance and health ministries pulled pages, MUFG Bank and JR West went into emergency maintenance, and Onamae shut all Desktop Cloud plans after malware hit up to 26,739 customer servers. India's eMudhra was found with eight intermediate certificate keys so weak one was literally the number 4, undermining trust in the 60M+ certificates it issued.
More from Safety
- Account hacks surge: 6-step emergency checklist plus an AI audit prompt — petergyang · 2026-10-23
- mmitchell_ai questions whether the AI safety vs security framing stems from EA — mmitchell_ai · 2026-10-23
- MPI-Sec PhD Thesis on Vulnerability Detection Benchmarks Includes Pre-LLM Classic "Top Score on the Wrong Exam" — mboehme_ · 2026-10-23
- Miles Brundage: 'beggars can't be choosers' still defines third-party AI eval access — Miles_Brundage · 2026-10-23
- Ex-OpenAI safety lead Miles Brundage: don't wait for SB 315, AI eval access needs legal requirements in months — Miles_Brundage · 2026-10-23
- New paper makes 9 falsifiable predictions toward a major AI-enabled terror attack by 2027-2028 — StephenLCasper · 2026-10-23