It all started with critical vulnerabilities found in PHP, a programming language that about 70 percent of websites depend on, but which quickly spread to Brotli (a file compression format commonly used by web servers) and Node.js (a software engine used by many web applications). We also learned that eMudhra, a distributor of digital certificates used by websites and apps to verify their identities, had been delivering compromised credentials.
If that all sounds like gibberish, substitute PHP for mad cow disease or Brotli for milk withdrawal. These have been staples of the Internet for years and now suddenly we can’t trust them.
Welcome to another edition of Prompt Mode, your weekly AI newsletter.
I’m your host, Ben Patterson. Every week in Quick modeI will offer analysis of AI trends that matter to everyday users like you and me. Stay tuned for practical AI tips, hands-on experiences with the latest AI tools, and (you guessed it) pointers to help you get the most out of your AI assistants.
Thanks for reading, and if you like what you see, just register here.
Why did so many things on the web break at once? Turns out they didn’t. Many of those vulnerabilities had been hidden and undiscovered for months or even years, and today’s advanced AI models are finally powerful enough to shed light on them, and they have, all at once.
Now, I thought I’d been pretty diligent about keeping my own home lab patched and up-to-date, but I asked Claude Code and Codex to crawl down to the basement and take a closer look.
What they found were errors. Many of them. That PHP vulnerability? Check. (My self-hosted RSS reader and read-later applications were open to PHP2Shell attacks.) Brotli’s mistake? Yes. (The unpacked packages on my four Raspberry Pis harbored the problem.) My home lab’s VPN was still relying on compromised eMudhra certificates, and unpatched Node.js runtimes were lurking among several of my other services.
Patching my home lab’s vulnerabilities is still a work in progress, with Claude Code and Codex filing one backlog after another, with my ChatGPT “dot” agent acting as auditor, jumping from one code repository to another in search of new bugs to eliminate. One of my systems, a Raspberry Pi 3 that is over a decade old, is currently down after a failed reboot to install patched OS packages.
