Who Pays When the Internet Needs a Bodyguard?

Jane Jones — Sat, 24 Oct 2026 20:52:22 +0000

This week, website owners learned that a vulnerability in PHP had been sitting in the foundations of the web for decades. The fix was to patch immediately or take the site offline. A TechCrunch podcast discussion of the episode described the internet, at its lowest layers, as “held together by glue and dreams.” The more interesting question is what happens next, and who ends up paying for it.

The patch is not the product

PHP underpins content management systems like WordPress and Drupal, which means tens of millions of sites. Many of their owners, from small shops to neighborhood associations, may not know PHP is in their stack at all. They have no security team and no budget for emergency engineering.

The panelists noted that Amazon spotted exploit attempts before the public disclosure using a honeypot network, a decoy system built to catch attackers. That is an extraordinary capability, and almost nobody else has it. The gap between what Amazon can see and what a small site owner can see is where a market gets made.

How a monopoly forms without anyone planning one

No one has to scheme for this to concentrate. The pattern is familiar:

Discovery requires scale. Finding and exploiting vulnerabilities now rewards whoever has the most compute, the best models, and the most capital. Only a handful of firms qualify.

Defense requires the same scale. If the labs that find the holes also sell the shields, the defensive tools come from the same few companies.

Everyone else rents safety. A small site that can’t afford its own monitoring will move onto a platform that handles security for it. The platform gets bigger, and the next vulnerability pushes more people toward it.

Switching gets expensive. Once your hosting, security, identity, and traffic filtering sit with one provider, leaving means rebuilding.

Each step is rational for the individual site owner. Added up, they produce a web where independent hosting looks reckless and a few companies hold the keys.

Where the consumer comes in

Consumers rarely see these costs directly. They show up as:

Higher bundled prices. Security costs get folded into hosting, subscriptions, and platform fees. A small business that pays more for protected hosting passes some of that on to customers.

Fewer independent options. When small sites go dark instead of patching, the loss is invisible but real. The panelists raised link rot, the quiet disappearance of sites that were taken down rather than fixed, and with them local resources and pieces of online history.

Less bargaining power. A market with three real suppliers of internet-scale defense is not a market where buyers set terms.
Data concentration. The companies that watch the most traffic for threats also see the most data. Security and surveillance can look uncomfortably similar.

The counterargument

It is not a foregone conclusion, and the optimistic case deserves a fair hearing. The same panel wondered whether new startups would emerge to fill the gap, and whether open source security tools, including ones offered by large hardware companies, could give smaller players a way to defend themselves. Open source itself is a decentralizing force, and the vulnerability in question lived in open code that anyone could audit, even if few did. Competition among the big providers could also hold prices down, and regulators have tools for dominant infrastructure providers if they choose to use them.

There is a real tension, though. Open source software is what let the web grow cheaply and widely, and neglected open source is also what created this exposure. The fix may be paying for the maintenance everyone has been getting for free.

What would keep this from becoming a toll road

A few things would help:

Funding for maintainers. Treat widely used open source components as public infrastructure rather than hobby projects.

Interoperable security. If protections work across providers, leaving one doesn’t mean starting over.

Responsible disclosure that doesn’t favor the big players. Vulnerability announcements shouldn’t give well-resourced companies a head start while everyone else scrambles.

Antitrust attention. If a few firms become the default defenders of the internet, that deserves scrutiny before the dependency is locked in.

The bottom line

The internet has always run on a mix of volunteers, shared code, and good faith. AI makes that arrangement easier to attack, and it may make the arrangement harder to sustain without someone stepping in. If the answer is a few large companies selling safety back to everyone else, consumers will pay through prices, lost choice, and lost privacy. Whether that happens depends on choices being made now, about who funds the foundations and whether the defenses stay open.

What do you think? Is the internet heading toward a few companies selling safety back to everyone else, or can open source and smaller players keep up? If you maintain or run sites on PHP, I’d especially like to hear how you’re handling patching. Leave your thoughts in the comments.

Sources and further reading:

Primary source for this piece

Will AI expose the rickety infrastructure of the internet?, TechCrunch (Anthony Ha), October 24, 2026. The Equity podcast discussion this article responds to.

The PHP vulnerabilities

PHP-ocalypse: how two critical web bugs almost broke the internet, TechCrunch. Reports that human researchers found the bugs, with AI used to exploit them.
php2shell technical write-up, calif.io. The researchers’ own account.
PHP2Shell, Black October: AI is changing everything about hacking, 404 Media. Covers the wider implications, including link rot.

Exploitation and response

Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure, AWS Security Blog. Amazon’s honeypot network saw exploitation attempts before the public announcement.
Matthew Prince’s post on escalating attack attempts, X. The Cloudflare CEO describes the surge in attempted attacks.

Related coverage

The internet is having a very bad cybersecurity day, TechCrunch (Sarah Perez), October 21, 2026.

DEV Community: Jane Jones

Who Pays When the Internet Needs a Bodyguard?