Matthew Prince on PHP2Shell, Duo on Arrival, 100 Really Difficult Phone Calls, Norwegian Gold Scheme

The biggest thread in the episode is Matthew Prince’s warning that the internet is entering a period of unusually intense security risk, driven by both old software flaws and AI-assisted discovery of new ones. He describes a PHP remote code execution vulnerability affecting roughly 70% of the web, says Cloudflare quietly deployed free protections for customers, and argues that everyone running PHP should patch immediately. He also points to a separate root-server certificate failure where an Indian operator used extremely weak passwords, illustrating how basic operational mistakes can still threaten internet trust.

Prince argues that AI is not mainly helping attackers yet; instead, it is helping defenders find weaknesses faster and coordinate fixes. He expects the next two years to be “fraught” with newly discovered vulnerabilities, but thinks the long-run result will be a more secure internet. He also says the balance of power will increasingly depend on compute, partnerships between model makers and security firms, and how quickly defenders can react.

He finishes with a bigger prediction: AI agent traffic will explode, eventually dwarfing human traffic and forcing a new internet business model. Prince expects micropayments and agent-targeted advertising to emerge because websites will need compensation when agents query huge numbers of pages without paying attention to any one result.