The internet has become one of humanity’s greatest repositories of cultural memory, yet much of that memory depends on software and infrastructure that require indefinite maintenance. AI is accelerating vulnerability discovery and, potentially, exploitation, widening the gap between the speed at which systems can become vulnerable and the capacity to secure them. The neglected corners of the internet, lacking the resources or the people to maintain them, risk becoming an unacknowledged digital graveyard: a slow-burning destruction of information and cultural memory that echoes the embers of Alexandria.
On 21 October, two critical vulnerabilities in PHP, a programming language underpinning much of the web, were publicly disclosed. Collectively known as PHP2Shell, the flaws can allow unauthenticated attackers to execute arbitrary code on vulnerable servers. PHP powers nearly 70% of websites. The flaws had remained undiscovered for more than a decade before researchers identified them with the assistance of AI tools, including Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. Their discovery demonstrates AI’s growing capacity to identify weaknesses buried deep within enormous codebases, including those that have eluded human researchers for years. To add insult to injury, details of the patch were leaked before the scheduled public disclosure, forcing an earlier release and narrowing the window available for defenders to prepare. Attackers can now study the flaws and develop exploits against both patched and unpatched systems. Organisations have responded by temporarily taking their systems offline. But an entire cosmos of websites exists beyond the reach of dedicated security teams and diligent administrators. Many will remain vulnerable.
Indefinitely.
Artificial intelligence is transforming vulnerability research. The latest models can sift through towering codebases developed over decades, identifying subtle weaknesses and finding needles in digital haystacks at a pace that would once have seemed implausible. I won’t waste your time debating the morality of its use. For better or worse, we are well past the point at which these conversations alone can determine the direction of the industry. AI-assisted tools are increasingly embraced by security professionals, while attackers and threat actors are finding their own uses for them. Even sceptics and lamenters such as myself, alongside my peers, are increasingly forced into a damned-if-you-do, damned-if-you-don’t relationship with the technology. And this is not confined to cybersecurity. In September, Anthropic reported that Yemen’s Houthis had used Claude Code to aid in their development of rocket guidance software and both ballistic and hypersonic missiles. Even Houthi engineers face the threat of AI to their job security and complex technical work. Safeguards sound nice in theory, but increasingly, it is becoming apparent that they are a myth.
In any case, this era of AI-accelerated vulnerability discovery and exploitation raises the prospect of an increasingly unsustainable maintenance window. Patches require understanding, development, testing, deployment and verification. Bureaucracy, for now, remains a largely human process. Large organisations have security teams and change-management procedures involving multiple stages of approval. An individual maintaining a personal website has neither. The result is an increasingly uneven security landscape: modern, well-maintained infrastructure may recover quickly, while under-resourced systems remain exposed, vulnerable to compromise and eventually liable to disappear. The consequences of this imbalance are usually quantified in terms of stolen credentials, financial losses and the cost of recovering compromised servers. These material losses can often be repaired, compensated for or otherwise mitigated. What cannot necessarily be recovered is the information and collective memory that slip through the cracks permanently.
The internet feels permanent because it has been available, almost instantaneously, for most, if not all, of our lives. Search engines retrieve decades-old news articles. Forums preserve the discussions of strangers who have long since moved on. Personal and community-built websites document interests, lives, languages and histories that might otherwise leave no historical footprint.
But accessibility is conditional.
Websites and the information they contain depend on hosting, domains, compatible software, databases, security updates and, above all, the labour and resources required to maintain them. Remove enough of these supports and information quietly slips from public view. An independent website documenting the language and oral traditions of a marginalised community might attract little traffic and generate no revenue. Its owners may have moved on, lost access to the server or simply run out of time and money. Yet the material it contains may possess immense historical and cultural value. Such websites are vulnerable not only to PHP2Shell but also to the wider and ever-growing catalogue of vulnerabilities that researchers and AI tools will continue to uncover. Without adequate maintenance, their survival becomes a matter of chance.
The burning of books and libraries is a catastrophe we can easily recognise. Information disappears from the internet every day, often without anyone noticing at all. An expired domain produces no smoke. A compromised server does not burn with bright flames. There is rarely an announcement, an inventory of what has vanished or an institution responsible for its recovery. Ironically, the Internet Archive, one of the best-known efforts to preserve the web, was itself briefly taken offline as organisations responded to the PHP vulnerabilities. Even dedicated preservation efforts are not immune to the fragility of the infrastructure on which they depend. Nor is preservation comprehensive: websites are not automatically archived, and archived copies may fail to retain interactive functionality, complete databases, user contributions and other elements of the original experience.
So who is responsible for preserving our digital memory?
Nobody, apparently. Unless us, maybe. I don’t know, to be quite frank.
But surely anyone but these cunts.
There is something particularly unsettling about the way AI companies have approached the preservation of knowledge thus far. Anthropic purchased millions of physical books, stripped their bindings, scanned their pages and discarded the originals to build a digital research library. The physical copies were destroyed in the belief that their contents would be preserved in a more useful form. But digitisation is not a guarantee of permanence. What happens when the digital library itself becomes obsolete, inaccessible or disposable? We risk destroying one record of our history to create another whose survival we cannot guarantee.
The internet has no central authority responsible for preserving its history. Much of what we find online exists because somebody, somewhere, took the time to create it and keep it running. Those people move on. Technology becomes obsolete. Money runs out. And often, nobody picks up where they left off.
We have mistaken the persistence of information on the internet for its permanence. The digital record is being created and lost in real time, and much of what disappears will leave no trace that it ever existed. I find it difficult to imagine how much of the internet we take for granted today will still be accessible in a decade, or how much of what vanishes will even be remembered.
We may be presiding over the destruction of our own history without even realising it.
Leave a Reply