When a Nobel-winning economist writes a column about the exact vulnerability you spent last week fixing, you read it closely.
In his latest piece, “Hack Apocalypse Now,” Paul Krugman writes about what security teams have been dealing with all week: PHP2Shell (CVE-2026-109618 and CVE-2026-109619). These are remote code execution bugs, meaning an attacker can run their own code on your server, and they were found with the help of AI. They briefly knocked several European government websites offline and had engineering teams rushing to roll out the patched PHP releases (8.5.12, 8.4.27, and 8.3.36).
Krugman’s big-picture instincts are right. He’s right that the AI data center boom is a huge misallocation of resources. He’s also right that it’s absurd for AI labs to treat the risk of human extinction as part of their pitch to investors.
Where he goes wrong is on the details: how the internet actually breaks, how modern cloud systems defend it, and, ironically, the economic failure underneath the bug itself.
I design and secure the kind of enterprise cloud platforms Krugman is writing about, so I want to walk through four things in his piece that I think are off. The real danger isn’t that you’ll have to visit a travel agent to book a flight on a 1980s SABRE terminal. It’s something quieter, and worse.
1. “PHP is old” misses the point. The real story is about money.
Krugman writes:
“Worse, much of the software is old — PHP dates from the early 1990s — and was hence designed in an era in which modern hacking techniques didn’t exist.”
Blaming last week’s crisis on PHP being from the 1990s is like blaming a modern plane crash on the Wright brothers.
Today’s PHP (versions 8.2 through 8.5) has very little in common with the simple scripts Rasmus Lerdorf wrote in the early ‘90s. It supports strict typing, has a JIT compiler, and manages memory automatically. PHP isn’t unusual here, either. The Linux kernel, OpenSSL, and many of the Python libraries that AI models depend on are also built on code that goes back decades. Age isn’t the problem. Funding is.
This is the part I’d expect an economist to jump on. PHP runs roughly 75% of websites whose server-side language is known, but the PHP Foundation, the nonprofit that supports it, works with a budget of around $700,000 a year.
Now look at the other side. AI companies worth trillions are spending hundreds of billions on giant data centers, often with power costs that end up shared by ordinary household utility customers. They scrape the PHP-powered web for training data without paying for it. Then their models are used to fuzz (bombard with huge volumes of automated test inputs) and pick apart the open-source code that a small group of mostly part-time maintainers is trying to protect on a tiny budget.
PHP didn’t fail last week because it was created in 1994. It failed because we’ve let a few giant AI companies keep the profits from the shared digital commons while the cost of maintaining and securing it falls on a handful of underpaid volunteers.
2. “Abliteration” isn’t a prompting trick
Citing Azeem Azhar, Krugman explains why safety training won’t stop hackers from using AI models to build exploits:
“Why? Because such training is relatively easy to ‘abliterate,’ which means reversing a few key prompts in a way that undoes most of the safety training.”
This mixes up two different things. Jailbreaking is tricking a model with clever prompts. Abliteration is changing the model itself.
You can’t abliterate a model by typing into a chat box. It only works if you have the model’s weights, the actual numbers that make up the neural network. You get those with open-weight or leaked models. The process goes roughly like this: you feed the model hundreds of harmful and harmless prompts and record its internal activity (the activations in its residual stream). By comparing the two sets, you can find the one direction in that activity that corresponds to the model refusing a request, known as the “refusal direction.” Then you edit the weights so the model can no longer move in that direction (a step called orthogonal projection). After that, the model simply stops refusing.
Why does this matter for policy? If people think abliteration means “reversing a few prompts,” lawmakers will assume the fix is better prompt filters on ChatGPT. In reality, once a model’s weights are public or leaked, someone can strip out its safety training in a few hours on an ordinary gaming GPU. Safety training slows attackers down. It doesn’t stop them.
3. Patch diffing won’t send us back to travel agents
Krugman is right about one real problem: AI-assisted patch diffing. When the PHP Foundation or Drupal’s security team releases a fix, anyone can compare the old code with the new code to see what changed. An AI model can do that comparison, work out exactly how the bug works, and produce a working attack in minutes. That’s usually long before every understaffed city IT department has installed the update.
But from there, Krugman jumps to a strangely nostalgic conclusion. He suggests the open web will become unusable, pushing us into “gated communities,” maybe even back to travel agents booking tickets over closed SABRE networks.
That’s not how modern infrastructure works. The gated community already has a guard at the gate, and you walk past him every time you load a web page.
Well-run cloud setups don’t expose application servers directly to the internet. The servers always sit behind layers that screen traffic first. So when PHP2Shell hit last week, nobody competent had to pull the plug. Before touching a single PHP container, we were able to block the attack across thousands of servers in minutes, using defenses that were already in place:
Blocking the attack at the edge (”virtual patching”). We added new rules to our web application firewall (WAF), a filter that inspects every request before it reaches us. Ours runs on a content delivery network (CDN), a service like AWS CloudFront or Cloudflare that sits between users and our servers. The new rules check request headers, character encodings, and serialized data for signs of the exploit, and they drop bad requests at the edge, far away from the actual server.
Hiding the real servers (”origin cloaking”). Our application servers ignore all traffic from the public internet unless it comes through the CDN and carries proof that it did (for example, signed requests through CloudFront or mutual TLS). AI scanners sweeping the internet for vulnerable machines can’t reach them at all.
Replacing servers instead of repairing them (”immutable infrastructure”). Rather than logging in and patching long-running servers one at a time, our deployment pipelines build a fresh, patched container image and roll it out across the whole cluster automatically.
The European government sites that went dark last week didn’t go down because the open internet can’t survive AI. They went down because public-sector IT has been underfunded for years, which left old servers sitting directly on the public internet without any of these protections.
4. The real threat isn’t inconvenience. It’s digital feudalism.
Krugman predicts the internet will split into gated communities, and that the extra security hassle will shave a few points off GDP. I think that treats a monopoly problem as a usability problem.
We’re not going back to AOL keywords or strip-mall travel agencies. We’re heading toward something more like a protection racket.
If an unpatched server on the open internet gets taken over in 90 seconds instead of 90 days, who can keep up?
Not the independent newspaper running its own website on a $20-a-month server.
Not the town government or nonprofit with one overworked IT person.
Not the hobbyist, the dissident, or the small business owner.
To survive “The Hackening,” almost everyone will have to put their online presence behind enterprise firewalls, zero-trust access systems, and AI-powered defense services run by Amazon, Microsoft, Google, and Cloudflare.
Look at how that loop works. Some of the same tech giants build AI models that are trained on the open web and make automated hacking far easier. That wave of hacking makes it impossible to stay on the open web without paying an ongoing security fee to those same companies.
Krugman worries that AI hacking will make us poorer by making us waste time at security checkpoints. I think it’s worse than that. AI is turning the open web into dangerous territory, and the companies that let the predators loose are the ones selling the only safe castles left.
Originally published on Substack.
Comments