I thought my homelab was secure. AI showed me how wrong I was
It all started with the critical vulnerabilities found in PHP, a scripting language that roughly 70 percent of websites depend on, but quickly spread to Brotli (a file compression format commonly used by web servers) and Node.js (a software engine used by many web apps). We also learned that eMudhra, a distributor of digital certificates used by websites and apps to verify their identities, had been passing out compromised credentials.
If that all sounds like gobbledygook, substitute mad cow disease for PHP or a milk recall for Brotli. These have been staple elements of the internet for years, and now suddenly we can’t trust them.
Welcome to another edition of Prompt Mode, your weekly AI newsletter.
I’m your host, Ben Patterson. Each week on Prompt Mode, I’ll be serving up analysis of the AI trends that matter to everyday users like you and me. Stay tuned for practical AI tips, hands-on experiences with the latest AI tools, and—you guessed it—prompts to help you get the most out of your AI assistants.
Thanks for reading, and if you like what you see, just sign up right here.
Why did so many things on the web break all at once? Turns out, they didn’t. Many of those vulnerabilities had been hidden and undiscovered for months or even years, and today’s advanced AI models are finally powerful enough to shine a light on them—and they have, all at once.
Now, I thought I’d been pretty diligent about keeping my own homelab patched and updated, but I asked Claude Code and Codex to crawl into the basement and take a closer look.
What they found were bugs. Lots of them. That PHP vulnerability? Check. (My self-hosted RSS reader and read-it-later apps were both wide open to PHP2Shell attacks.) The Brotli bug? Yup. (Unpacked packages on all four of my Raspberry Pis were harboring the issue.) The compromised eMudhra certificates were still trusted by my homelab’s VPN, and unpatched Node.js runtimes lurked among a number of my other services.
Patching my homelab’s vulnerabilities is still a work in progress, with Claude Code and Codex filing one to-do item after another, with my ChatGPT “dot” agent acting as an auditor, hopscotching from one code repository to the next for new bugs to squash. One of my systems, a Raspberry Pi 3 that’s more than a decade old, is currently down for the count after a failed reboot to install patched OS packages.
