This week brought a reminder that the security story we’ve been following in bitcoin is part of a much bigger one. PHP patched two critical flaws that could let an unauthenticated attacker run code on a vulnerable server. Node.js shipped security updates, including a high-severity flaw in its Brotli decoder that could allow code execution when an application decompresses malicious input. PHP and Node are basic plumbing for a huge portion of the internet. People responsible for those systems need to update them, fast.
The AI angle is already tangible. Wiz used frontier models to help turn the PHP flaws into working exploits, while the PHP Foundation describes using AI tools to validate reports and help its security team triage them. A developer had noticed the underlying PHP out-of-memory problem in 2024; the recent research established just how dangerous it could be. Amazon saw exploitation attempts against its honeypots before public disclosure. Defenders are finding and fixing weaknesses faster, while the window they have to patch them may be getting brutally short.
We’ve watched a Coldcard seed-generation failure, the Liquid exploit and the Ledger implant put bitcoin custody systems under a microscope. It makes sense to me that attackers would chase money first. Compromise the right wallet or exchange system and the payoff can be immediate: the code is the money. Elsewhere, an attacker may still have to steal and sell data or hold a business for ransom. I expect more disruption as these capabilities spread, including in the digital systems that support essential services. An outage in a pipeline, water utility or power grid would hit a lot harder than a broken website. I also expect this contest to leave us with a stronger security stack. Until then, know what’s in your digital supply chain and how fast you can patch it.