Oct 21, 2026 · 1h 34m
PHP vulnerability exposes the internet’s neglected long tail
The Internet Is Finished, Early iPhone Duo Reviews, SpaceXSITesla Merger Talks | Nikesh Arora, Aidan Smith, Akhil Iyer, Max Junestrand
The episode connects a major PHP security flaw to fragile infrastructure, AI-enabled attacks, and the widening demands placed on computing systems.
- 1The PHP vulnerability shows how a widely used technology can expose smaller businesses and public services with limited security resources.
- 2SpaceX’s compute strategy and possible Tesla merger reveal competing incentives around infrastructure, valuation, and future AI demand.
- 3New AI companies are applying specialized systems to chips, military planning, and legal work while enterprise adoption remains cautious.
Don't miss
Nikesh Arora explains why the PHP vulnerability could become a Log4j-scale event and what exposed website operators should do.
The brief
A severe PHP vulnerability becomes the episode’s central warning: coordinated patching can address the immediate flaw, but neglected websites and government services remain exposed.
Nikesh Arora of Palo Alto Networks frames the vulnerability as potentially Log4j-scale and argues that operators need patches or virtual protections as AI accelerates vulnerability discovery.
The hosts then examine technology’s capital-intensive frontier, from iPhone Duo design compromises and SpaceX’s compute ambitions to a possible SpaceX-Tesla combination.
Aidan Smith discusses Flapping Airplanes’ $800 million financing and megakernel work, while Akhil Iyer explains how Watchtower applies AI to military planning and uncertainty.
The closing discussions turn to legal AI, enterprise adoption, and OpenAI’s Google Cloud deal, extending the episode’s question: who can build and secure the next layer of infrastructure?
What was said on this episode
32 statements · 11 positive · 15 negative · 4 mixed · 2 neutral
About 70% of websites run on PHP.
“something like 70% of all websites run on PHP”
Listen at 3:22
Many private data records on vulnerable websites will leak.
“Feels like we're very close to, or effectively it's unavoidable that a lot of this stuff is gonna leak out.”
Listen at 4:46
PHP2Shell is PHP's most severe security issue in over a decade.
“It is the most severe security issue that PHP has faced in more than a decade.”
Listen at 5:27
AI enables researchers to find thousands of software bugs.
“AI is enabling well-meaning security researchers to find thousands of software bugs”
Listen at 7:58
Many sites will be hacked and user data exposed after the patch.
“there's going to be so many sites hacked and so much user data exposed, I think.”
Listen at 11:41
Trevor Milton's private-aviation strategy is unattractive.
“I was quite bearish on, on, on this strategy.”
Listen at 15:09
Private aviation is probably a poor strategy for Trevor Milton.
“going into private aviation where you have super discerning buyers is just not probably a good business strategy.”
Listen at 15:31
Trevor Milton's stigma discount could create a plane-buying opportunity.
“there's some kind of stigma discount that you can get on the plane because, like, if other people are worried about buying from him, that's a buying opportunity for me”
Listen at 15:40
iPhone Duo app-optimization problems will be fixed quickly.
“I think this kind of thing will get fixed pretty quickly.”
Listen at 17:51
A SpaceX–Tesla merger appears inevitable.
“This seems inevitable at this point.”
Listen at 28:45
Humanoid robots may initially find product-market fit in home security.
“I can see humanoids having more product market fit in the home for security use cases early on.”
Listen at 34:36
AI-discovered cybersecurity vulnerabilities will increase.
“We're gonna see more of these, not less.”
Listen at 36:39
More major vulnerabilities will emerge within 6–12 months.
“It's probably the next 6 to 12 months, you'll see more of these.”
Listen at 36:49
PHP2Shell persists across roughly 9–22 million locations.
“there's 22 million places where this vulnerability persists. Even if you thin it down, it's about 9 or 10 million.”
Listen at 37:05
Future AI models will find vulnerabilities current models miss.
“what isn't found today with the current models will definitely be found 3 months from now with the next model.”
Listen at 39:33
Everyone should take AI-enabled cybersecurity threats seriously.
“my recommendation to everyone is take this stuff seriously”
Listen at 39:41
Major breaches will result from AI-enabled vulnerabilities.
“we will see some big breaches as a consequence of some of these things.”
Listen at 43:01
AI technology lacks sufficient observability and security hooks.
“AI as a technology has not even built the hooks that are needed to make sure you can observe it and you can secure it.”
Listen at 48:36
Users currently restrict personal agents from sensitive actions.
“there are certain, I'd say, boundaries right now. With personal agents where people do not want to give them access to certain actions or tasks.”
Listen at 51:33
Personal agents need trust, explainability, and auditability before widespread adoption.
“I think there's a bunch of stuff that needs to get resolved, a bunch of trust that needs to be built and comfort that needs to be built, and explainability, auditability before those things become commonplace.”
Listen at 52:05
Open-source or open-weight models enable chain-of-thought inspection.
“the only models that allow the inspection of chain of thought today are fundamentally open source, open weight models.”
Listen at 53:11
AI compute demand will remain insatiable for 3–5 years.
“there's no question that there is going to be insatiable demand for the next 3 to 5 years.”
Listen at 57:08
Flapping Airplanes' megakernel framework enables previously infeasible GPU workloads.
“you can actually run things on GPUs that people thought really were not possible.”
Listen at 59:42
Future AI work will be especially effective on GPUs.
“we think that a lot of the AI work into the future will really be especially effective on GPUs”
Listen at 1:00:57
Modern model brittleness mostly results from post-training.
“I think that's mostly downstream of the post-training.”
Listen at 1:06:15
Watchtower Labs' platform simulates outcomes to improve military decisions.
“we went off and built a platform that can help military planners think about the future, simulate a distribution of outcomes going into the future, and ultimately help them make better decisions”
Listen at 1:10:12
Black-swan events remain possible despite simulation.
“black swans are possible.”
Listen at 1:11:01
Frontier models accelerate planning unevenly because infrastructure constrains deployment.
“it is definitely accelerating in some places, but it is staggered a little bit because of what the infrastructure can provide”
Listen at 1:13:28
Legal AI adoption is accelerating but more cautiously than software AI adoption.
“the degree of adoption is accelerating exponentially, but it's doing so at a more, you know, careful rate.”
Listen at 1:18:32
Legal AI lets small firms handle more and more complex work.
“it's helping the small firms and small in-house teams take on substantially more work and do substantially more complex work than they were able to before.”
Listen at 1:19:59
External legal-AI benchmarks are not reliable.
“I don't find that the external benchmarks are very good.”
Listen at 1:23:32
WAP resembles Shopify for a new internet-work category.
“WAP is the Shopify for a whole new category of work on the internet.”
Listen at 1:31:48
Statements are attributed to the speaker as said on the episode and reflect their view at the time, not PodLume's. They are not advice.
Weekly email
State of the Pod, every Monday
The week's most-discussed names and stories from podcasts, with the moments behind them. Free, five minutes, unsubscribe in one click.