Two letters to the Guardian, responding to a Chris Stokel-Walker column about internet fragility, land on a distinction that most coverage of the PHP vulnerability story missed entirely. The bugs in PHP's source code were old, obscure, and harmless until someone decided to make them public before a fix was ready. The AI tool that found them was doing exactly what security researchers have wanted automated tools to do for years — scanning vast codebases for flaws that human eyes would never catch. David Gibson of Leeds makes the sharpest point: the problem was not discovery but disclosure. Responsible disclosure — the norm in cybersecurity for decades — means you tell the maintainers first, give them time to patch, and only then go public. Someone broke that norm. Whether the leaker was a researcher seeking attention, a malicious actor, or simply careless, the effect is the same: weaponizing a vulnerability by broadcasting it before a fix exists. Gibson's call to criminalize premature disclosure is blunt but raises a real policy question. Many jurisdictions already have computer misuse laws, but the act of publishing vulnerability details occupies a grey zone between free speech, security research, and recklessness. The EU's Cyber Resilience Act and the US CFAA both dance around this without cleanly addressing the timing problem. Charles MacKinnon of Glasgow takes the wider view, channeling Carl Sagan's 1995 warning about a society dependent on technology it doesn't understand. His argument is structural: decades of grafting middleware onto legacy systems, driven by commercial pressure to cut costs and increase margins, have produced an infrastructure that is fragile by accumulation rather than by design. He calls it "Y2K Mark 2, but this time it's for real." MacKinnon's framing is less precise but more important at scale. The PHP incident is a single data point in a pattern: critical internet infrastructure maintained by small, under-resourced open-source teams, running code that nobody has audited comprehensively until AI tools made it feasible. PHP powers roughly 77% of websites with known server-side languages. The attack surface is enormous and the maintenance capacity is thin. The generative story here is real. AI code auditing represents genuine new capability — the ability to systematically scan codebases that no team of humans could review at scale. That is value creation. But the disclosure failure reveals a governance layer that hasn't kept pace. Technology that finds vulnerabilities faster is only as useful as the institutional norms that govern what happens next. Both letters, in different registers, point to the same structural deficit: the gap between the systems we depend on and the governance we apply to them. One wants a specific legal fix. The other wants a reckoning with the entire model. Neither is wrong.
