The internet was always vulnerable, AI is finally showing it the mirror

“The funny thing is everyone was saying AI slop code will cause a cyber crisis but it’s actually all the old human slop causing it and the AI is just cleaning it up,” Ben Kaufman writes on X, the platform formerly known as Twitter, following the events of Black October. We do not know who Ben is at this point except that he is, as per his profile, an unlicensed software engineer with “shadowy super-coding” skills.

“Yes, and yet I still get told almost daily that we humans were pristine coders who curated wonder and awe with our code,” Paul concurs. We do not know his last name but in his bio, Paul calls himself an “e/acc tech bro” suggesting that he strongly believes in the ideology of change and innovation in sharp contrast to all the ongoing doomerism around AI. His resume is impressive with names like Red Hat making a prominent mention.

Suddenly Steve Brownlie enters the conversation, holding back no punches whatsoever: “It’s not surprising that we were arrogant enough to pretend we were perfect before.” Steve is a fractional CTO who, if you are struggling to get your product shipped, will “get you over the line.”

Ben, Paul and Steve are not necessarily related. Yet on X, they appear to be on the same page. And they are not alone. There are countless others like them. They are talking on other platforms like Reddit, too. Consensus is brewing among humans. The internet—World Wide Web really—is swarming with confessions that software developers were never that good.

Reality check

On October 17, an independent researcher with the alias “Wayne” discovered a critical cryptographic vulnerability linked to eMudhra, a major Indian Certifying Authority (CA). No hack or data breach caused it. Instead, it was a subtle script error sitting quietly in plain sight, waiting to be found for 18 months.

Within hours of the discovery, Google, Mozilla, Apple, and Microsoft blocked the affected intermediate certificates. By October 22, eMudhra’s Board voluntarily withdrew from the global SSL/TLS certificate business to refocus on its core enterprise solutions. The Indian Computer Emergency Response Team (CERT-In) issued an advisory, and the Ministry of Electronics and Information Technology (MeitY) reassured the public that the domestic certifying ecosystem and eSign services remained unaffected.

While this was happening, the world was hit by another major storm. PHP had been compromised or at least humans were able to finally detect two big flaws—within the very system they had created years ago—critical enough to prompt an alert from the National Security Agency of the United States even as several government websites went completely offline across Europe as a counter measure to prevent any untoward activity.

To give you some perspective, PHP drives nearly 70 per cent of the websites and web applications we use almost daily. OpenAI quickly swooped in to take credit. Its AI had cracked something which no human could for over a decade. Not a good look for “legacy” software that developers took great pride in for writing everything by hand.

The eMudhra incident, alongside similar recent vulnerabilities uncovered in PHP and even in Node.js, prove the internet was always vulnerable. The spate of “cyberattacks” we’re seeing now is just AI finding bad human written code and exploiting it.

We didn't have the tools to see the cracks earlier. Today, AI is holding up the mirror. As one programmer, Russell Busch, puts it so eloquently on X, “Devs knew that every bit of software they read was garbageexcept for their own.”

In April 2025, eMudhra conducted a key generation ceremony for eight intermediate Certificate Authorities. These cryptographic keys are the digital equivalents of master keys to highly secure vaults.

“These keys are generated in a secure hardware. Think of it as a key to a door; if the key is strong, you can't duplicate it,” Kaushik Srinivasan, Co-Founder of eMudhra tells India Today Tech. The hardware was secure, and the process complied with relevant standards. The failure occurred during a specific technological process called “wrap and unwrap,” designed to export keys for global operations by creating encrypted and decrypted copies.

“When we did the decrypted copies, things went wrong. There was a script error,” Srinivasan notes. “In layman's words, it resulted in a very simplistic key that would open a door. You can now guess it quite easily.”

One of the keys, as it turns out, was simply the number “4”. Fortunately, the compromised intermediate issuers were never put into production, meaning no rogue identity certificates were ever issued to websites. “It's a process lapse. There was no infrastructure attack. There was no data leak,” Srinivasan clarifies. However, the revelation that a weak key lived undetected in browser root stores for a year and a half hasn’t gone unnoticed with eMudhra in the thick of things facing global scrutiny.

For the average user, the small padlock sign next to a URL, symbolizes digital security. It is what confirms that a website is legitimate. But that padlock is only as reliable as the complex chain of trust below it.

“HTTPS runs on a chain of trust: your browser trusts a website because its certificate traces back to a trusted authority,” explains Nandini Tandon, Co-founder and Chief People Officer at Indusface. “An intermediate CA key sits high in that chain. Whoever holds one could issue certificates for any website that affected systems would accept. Encryption isn’t broken; identity is.”

If a hacker had exploited the eMudhra flaw, a user could have seen a valid padlock while potentially giving away sensitive data to a perfectly disguised impostor.

Browser makers like Google and Mozilla patched the vulnerability within hours but modern digital infrastructure extends far beyond web browsers. APIs, payment integrations, mobile backends, and legacy servers often maintain their own isolated trust stores that do not receive automatic browser updates.

“Those systems may still trust certificates the rest of the internet has already blocked,” warns Tandon. “Your browser was patched in hours. Your backend may still be trusting a compromised key today.” The operational mandate for enterprises is brutal but necessary: find every certificate, update trust stores directly, and validate the changes. Certificate replacement isn’t paperwork. Done badly, it is an outage. Not done at all, it is an open door.”

AI is the mirror and the microscope

The vulnerabilities exposed in eMudhra’s wrap-and-unwrap script or PHP's legacy memory handling are not new phenomena. Software development has always been a messy, human endeavour. It is imperfect because humans are not perfect. What has fundamentally changed in 2026 is the speed and scale of discovery.

“The internet was always vulnerable. AI is showing it the mirror,” asserts Tandon. “The weakness that exposed eight trusted certificate authority keys was not a sophisticated AI attack. AI did not create that flaw, but it makes flaws like it faster and cheaper to find, for attackers and defenders alike. AI isn’t creating new cracks in the internet. It is shrinking the time between a crack existing and someone walking through it.”

Historically, uncovering cryptographic script errors or deep-seated memory bugs required time and technical expertise. Today, generative AI and advanced Large Language Models (LLMs) have commoditised the whole process.

“AI is enhancing the efficiency of hackers by automating reconnaissance, analysing documents, pinpointing malfunctions, and planning actions,” says Mandar Patil, EVP at Cyble. He points out that software vulnerabilities often stem from treating security as a reactive layer applied post-development, rather than a foundational core principle.

This creates an asymmetry. Defenders must secure massive supply chains and identity systems, while attackers, supercharged by AI, only need to find a single forgotten script error. “Anybody can use AI, generate a script, and figure out loopholes in various systems,” Srinivasan adds, noting that AI capabilities now vastly exceed what humans can do collectively at scale.

As AI accelerates the discovery of vulnerabilities, the legal and compliance frameworks governing the world at large require a massive overhaul. Ignorance is not bliss anymore.

“The eMudhra and PHP episodes are not a sudden collapse of digital security. The internet always had these weaknesses,” says Saakar Yadav, Founder and Managing Director of Lexlegis.ai. “AI has simply made them visible faster and cheaper than ever before, and that changes the legal conversation.”

Under frameworks like India's Digital Personal Data Protection (DPDP) Act and CERT-In's strict incident reporting mandates, organisations are legally obligated to maintain “reasonable security practices.” But AI is redefining what constitutes “reasonable.”

“What the law does not yet answer is who bears responsibility when an AI tool could have found a weakness in minutes, but nobody noticed it for months,” Yadav points out. “As discovery becomes easier, the benchmark of reasonable care will rise. Regulators will rightly ask why organisations did not test themselves with the same tools that researchers and attackers now use.”

Because AI agents can now uncover in an afternoon what used to take human teams weeks, the industry urgently needs clearer rules on responsible vulnerability disclosure, safe harbor provisions for good-faith researchers, and defined obligations for the vendors whose code holds up public infrastructure.

Fighting fire with fire

If AI is the microscope exposing the internet’s flaws, it can also be the tool used to repair them. Security leaders agree that the days of manual, point-in-time compliance audits are over. Organisations must move from reactive patching to continuous, AI-assisted validation. “There are AI-powered systems that can analyse the information flow in networks, detect anomalies, find the most dangerous weaknesses, and react to incidents in real-time,” notes Patil. Secure software development, independent audits, and constant penetration testing are no longer optional best practices.

However, leaning entirely on automation brings its own risks. “AI has to be part of your armour,” says Srinivasan, acknowledging that humans can no longer defend networks at the required scale. “But we cannot entirely rely on AI because models do hallucinate. Pairing both human and AI controls to make the whole system more robust is where the focus must be.”

Yadav couldn’t agree more. “AI follows the oldest rule in computing: garbage in, garbage out. AI can point to the crack in the wall. Proving it, fixing it, and answering for it still require evidence, rigor, and human accountability.”

The eMudhra incident is a wake-up call for the global tech sector. As a Make in India pioneer that built much of the early digital signature architecture for the country's tax, customs, and Aadhaar-linked eSign ecosystems, eMudhra’s exit from the global SSL/TLS business is a sign of things to come. AI has stripped away the illusion that our digital foundations were flawless. The internet is on fire. Legacy software like PHP is failing. But things are about to get much worse—for the human-built network of networks—if OpenAI and Anthropic are anything to go by. The cracks have always been there. Now, the lights are on.

Humans have an uncanny ability to survive. This too shall pass. But it’s going to take a lot of effort.

- Ends