A research team at Wiz, the security firm owned by Alphabet ($GOOGL), worked alongside researchers from OpenAI last week. Together they traced a flaw buried in PHP, the scripting language that has run a large share of the web since the 1990s. Nothing about the underlying bug was new; what changed was who found it, and how fast word of it spread.
TechCrunch covered the resulting scramble as ancient PHP holes panicking the internet, with website operators rushing to patch code written before many of their engineers were hired. If a machine can comb through decades of neglected script and surface holes that human reviewers missed for years, why did the discovery still feel like an emergency instead of routine maintenance?
The specific holes in PHP were not really the cause of the alarm. What the research exposed is how much of the code running today’s web depends on other code that no one mapped when it was written. A function three layers deep in one file can rely on behavior defined in another file no one has opened in a decade, and neither the original author nor the AI reviewing it now has a full picture of who else leans on that link.
Blacksmith, a startup that tests AI-written code before it ships, hit a $1 billion valuation last week, Fortune reported, as AI-written code volume surges industry-wide. That valuation only makes sense if investors believe the less comforting story: that AI does not shrink this problem. It makes the pile of untraced dependencies taller, stacking fresh, unproven connections on top of old ones that were brittle to begin with.
The common assumption is that AI code review gets better over time and eventually resolves the vulnerability problem on its own, catching what the last generation of tools missed until little is left to find. That is not what is happening. Each generation of AI-written code adds dependency chains too deep and too fast-changing for any analysis tool, human or machine, to fully trace before the next deploy. Rhiannon Beaubien and Rosie Leizrowice, in The Great Mental Models Volume 3, argue that resilient systems keep a measure of independence between their parts: “Dependencies tend to age poorly because they rely on every one of their dependencies aging well.”
PHP’s architecture, built up over three decades with independence never designed in, is precisely the kind of structure that principle warns about; every new layer inherits every old weakness it touches. They document how far a single crack can travel, assigning a blast radius to each discovery rather than closing the chain that produced it.
If that is what verification tools are actually doing now, mapping reach rather than preventing failure, the market around them would probably reorganize to match. Five years from this scramble, the models Google and OpenAI pointed at PHP’s old dependency chains could be valued less for how many flaws they find and more for how precisely they trace what a single flaw touches.
Blacksmith and its competitors would probably shift from selling code tests to selling maps of cascade risk, a subscription that tells a company not just that a vulnerability exists but how many of its systems, vendors, and customers’ systems sit downstream of it. Insurers and regulators would probably start asking for that map before a breach instead of after one, the way a flood map already shapes a mortgage’s cost long before anyone has seen water.
The PHP holes did not alarm the internet because they were old. They alarmed it because they proved, in public, that the modern web runs on a structure no single mind, human or artificial, can trace to its edges. Blacksmith’s billion-dollar valuation reflects a world that no longer finds that fact surprising. It is just Tuesday.
Leave a Reply