Armin Ronacher reads the AI bug wave as payback for 30 years of bad software

Armin Ronacher, creator of the Python framework Flask, summed up the mood among developers in one line: AI is fun, but the universe is now punishing us for 30 years of bad software. The numbers from the latest PHP case show where that punishment hurts most. Finding holes has sped up. Fixing them has not.

One post on X captured a week of models digging up old holes

Ronacher posted the line on X on October 22. Simon Willison quoted it on his blog the same day and tagged it security and ai-security-research, the label he uses for posts about finding vulnerabilities with AI. Ronacher's post does not say what exactly prompted it. It is an observation, not an analysis with data.

Willison supplied the context a day earlier. On October 21, the PHP project shipped fixes across the PHP 8.x line for two holes that let an attacker run code on a server. Both carry a CVSS score of 9.2. According to the published timeline, Wiz Research found the first one on August 19 using its own Wiz Atlas tool together with the Gemini 4 Argon and GPT-5.6 Sol models. The very next day the team confirmed an unauthenticated attack against Drupal, and a day later against WordPress.

Models shorten bug hunting, while fixes stay just as slow

The timeline shows an asymmetry that Ronacher's line leaves out. From discovery to a working attack on Drupal took one day. From discovery to a patch took 63 days. Wiz reported the bugs on August 24, the PHP team acknowledged them on September 21, and the fixes landed on October 21, a day earlier than planned because of a leak.

That is the core problem for anyone running older software. Models can read code nobody has looked at for years and find a way in. They do not write the fix for the maintainers, test it across millions of installs or persuade companies to upgrade. Thirty years of debt can be discovered in an afternoon, but it will still be paid off at human speed.

For security teams, this shifts the balance over time. Whoever has access to similar models can find a hole before the maintainer manages to patch it. The window between discovery and fix becomes the most valuable and most fragile part of the whole process.

The universe punishes no one, specific maintainers pick up the bill

Ronacher's phrasing is sharp but fatalistic. The word punishment suggests a force of nature. Bad software was written by specific companies and projects, and today the fixes often rest on a handful of volunteers. PHP, Drupal and WordPress are also targeted precisely because they run nearly everywhere, not because they are worse than the rest of the web.

The second caveat is scale. One quote and one case do not prove that AI has triggered a wave of new attacks. They show that models helped researchers find serious bugs faster. How many such findings end up with attackers instead of maintainers is not yet known from public sources.

Whether the path from discovery to patch gets shorter will decide this

It is worth watching whether large open source projects start cutting the time from report to fix. For PHP it was 58 days from report to release. If those numbers do not shrink, the advantage stays with whoever is searching, not whoever is fixing.

The second signal is money. The labs whose models find these holes could hand part of the advantage back to maintainers through funding, repair tooling or priority access to models for defense. The third signal is the disclosure process. The PHP leak showed that old coordination routines do not account for a model writing an exploit in a few hours.

Lilith's verdict

The models walked into a basement nobody had lit for thirty years and flipped the switch. The mould was always there; now the burglars can see it too, while the number of maintainers holding a paint bucket has not changed.