Uneasy Money: Is the Internet Breaking Because Bots Never Get Lazy?

The certificate and PHP incidents discussed by Taylor Monahan appear unrelated, despite both exposing fragile internet infrastructure. Monahan expects further incidents connected to each issue in the coming weeks, but says it is unclear whether their timing reflects better models; another speaker says models have not improved recently. The discussion also stresses that a person still has to decide to act. Its broader concern is that persistent automation can test systems at a scale that human operators never did, undermining assumptions that nobody will exhaustively search every possibility.

PHP remains deeply embedded: Monahan estimates about 80% of websites still use it, while other speakers put the figure closer to 70% and acknowledge uncertainty. Researchers found two PHP vulnerabilities that permit remote code execution. An attacker can run code on an affected server without physical access or prior authentication if the site is exposed and unpatched. Compromised servers could be used for phishing, command-and-control activity, SEO spam, or Monero mining. The risk includes old admin interfaces and services supporting important systems, not just neglected blogs. Remediation may require updates across Linux, WordPress, hosting providers, and privately managed enterprise or government systems. Cloudflare wrote custom WAF rules to block attacks on PHP admin screens while customers update.

The certificate failure involved E-Mudhra, an Indian certificate authority that reportedly used the number 4 as a private key instead of generating a genuinely random one. The key had been used to sign certificates since April 2025 and for more than a year by the time of the discussion; E-Mudhra was audited twice during that period. Eight certificates reportedly had values between 0 and 256. Speakers suggest a bit-width or implementation mistake could explain the weak values, but the cause is unknown. Because certificate authorities sign credentials used for HTTPS, code signing, and other security functions, one issuer’s failure can weaken a wider trust chain. Mike Lenker compares the setup to a 1-of-150 multisig: there may be 150 signers, but one signature is enough.

E-Mudhra representatives reportedly said they had no indication the certificates were exploited, but a speaker questions how reassuring that is and speculates that a nation-state may have known about the weakness. No evidence establishes that this happened or caused visible damage. Revocation is also uneven: Google, Mozilla, and a researcher were discussing the issue by email, and some devices do not check online for revoked certificates. Updated browsers can reject a revoked certificate without a manual update, but older devices could remain vulnerable for years, possibly a decade. Ideas such as publishing public keys in a smart contract, using attestations, or adopting peer-to-peer trust offer alternatives, but revocation could still bring human decision-makers back into the process.

A crypto test illustrated how automation can exploit assumptions about unsearched values. After a dollar was placed in a selected account, three transactions were pending in the mempool attempting to take it. The selected number, 6969, was small but had no nonce. A speaker guessed that automated theft might become less likely beyond numbers with roughly 8–12 or 12–16 digits, while emphasizing the uncertainty; the group planned to test more numbers. The discussion links this problem to the persistence of automated testing, rather than establishing that the incidents all share a cause.

The speakers also warned that highly leveraged on-chain systems are hard to simulate and vulnerable to oracle manipulation; one example involved heating a Paris airport temperature sensor with a hairdryer to change the measurement supplied to an oracle. They said $138 million had been deposited in one system, where a “paper” incentive token could be earned through losing trades and might provide fee or staking returns. Incentives can create attack vectors, and a seven-day time lock constrained the team’s ability to respond. The team was considering keeping paper non-tradable after the lock expired, but the discussion did not establish a final decision. Speakers expected AI tools to make protocols easier to build and potentially revive aggressive, even Ponzi-like, yield farming.

In the broader AI discussion, speakers described models as getting cheaper to run and smarter, and argued that a frontier lab that remains at the frontier while achieving positive cash flow could be extraordinarily valuable. DeepSeek was cited as offering inexpensive open-weight models through an API: one speaker’s costs fell from about $500 in a week to roughly $50 after Flash became about ten times cheaper, then to about $3 in a month. They raised concerns that prompts or sensitive information sent to Chinese services could be exposed, while noting uncertainty about the scope of a reported DHS restriction on government use. As models handle harder tasks, speakers expect users to share more personal information, including conversation histories and screenshots, and said they had already become less careful about what they submitted.