Oct 27, 2026 · 32 min
Listen from 0:55
Listen at 0:55
AI hype obscures the real danger in aging software
Vibe coding will bankrupt businesses | David Gerard
The episode separates publicity-driven claims about AI security from the harder problem of keeping vulnerable, unsupported systems patched.
- 1The PHP flaw exposed how AI companies can turn routine security work into publicity and credit-seeking.
- 2Chatbots may find obscure bugs, but automated tools still outperform them for many systematic security checks.
- 3The greatest risk lies in aging websites, appliances, and specialized systems that cannot reliably receive updates.
Don't miss
The conversation contrasts the overhyped PHP vulnerability with eMudhra’s more consequential certificate failure, while keeping AI involvement explicitly unproven.
The brief
David Gerard and Isaac Pound begin with a critical PHP vulnerability, questioning whether AI-assisted discovery improves security or mainly creates publicity for companies seeking credit.
The flaw mattered because PHP powers parts of the web, including WordPress, but well-maintained sites were better positioned to receive updates than neglected systems.
The discussion turns sharper with eMudhra’s weak cryptographic keys and certificate-business consequences, while any role for careless AI-assisted work remains unproven.
Gerard argues that chatbots can uncover some low-hanging bugs and corner cases, but fuzzing and other automated methods remain more dependable for systematic testing.
The deeper threat is the long tail of unsupported software: websites, appliances, and specialized systems that may remain vulnerable for years, echoing the unfinished work exposed by Y2K.
Weekly email
State of the Pod, every Monday
The week's most-discussed names and stories from podcasts, with the moments behind them. Free, five minutes, unsubscribe in one click.