The Night the Internet Pulled Its Plug: AI Found a 10-Year Bug
Plays from YouTube. Audio in English, German, Spanish and Japanese: pick a track under Settings in the player. Open on YouTube
About the film
A bank in Japan, the Port of Rotterdam in the Netherlands, government institutions… As the PHP2Shell alarm grew, websites and some services were being taken offline as a precaution. While everyone waited for the security update, attack attempts had already begun.
With the help of AI, researchers had uncovered how flaws that had sat in PHP, at the foundation of the internet, for more than ten years could be exploited. Now everyone faced the same questions: Would the update arrive in time? Why was this flaw so dangerous?
In this documentary, we look at why institutions took their own websites offline, how far the attackers were able to reach, and how an update we trust can turn into a trap. Did anyone get in before the doors closed? And what if, while everyone rushed to update, the update itself was the trap?
What happened, by date
-
Amazon's honeypots record attempts to exploit the flaws, four days before they are made public.
Amazon Threat Intelligence -
A separate incident: LiteLLM's official 1.107.0 release carries credential-stealing malware. It stays up for about two hours.
LiteLLM -
Japan's Prime Minister asks website owners to be ready to patch that night, and says temporarily stopping a site is one way to reduce the risk.
Sanae Takaichi on X -
PHP publishes the fixes and its security advisory.
php.net -
CISA adds both flaws to its catalog of vulnerabilities known to be exploited.
CISA Known Exploited Vulnerabilities catalog -
Wiz reports that among the organisations it monitors, fewer than 53% of those initially affected were still vulnerable one week after disclosure.
Wiz
“You need to be looking at your watch, not a calendar, when you're thinking about patching this.”
Main sources
- Amazon Threat Intelligence
- Attack attempts seen before public disclosure
- Dream Research
- The PHP2Shell attack on firewalls
News, interview and archive sources
BBC News, BBC Radio 4, NTV (news zero), TBS, CNBC, Wiz “Crying Out Cloud” podcast and Sanae Takaichi's posts on X.
Music and sound effects: Epidemic Sound. Research, writing and editing are my own. The narration was made with an AI clone of my own voice.