Technical debt has moved from a “should” to a “must”.

The (latest) AI cybersecurity incident brings a very boring topic to the table: technical debt.

Technical debt is like buying new tyres for your car. It costs money and the car feels the same afterwards.

Technical debt is when some part of your software system needs to be updated. The CEO says: “customers pay for features. This is not a feature.” The CTO says: “is this our MIP?” The CFO just says no.

PHP (the subject of the latest incident) has evolved so substantially since version 5 that bringing a legacy application up to a supported version can be closer to a significant software modernisation project than a routine runtime upgrade.

As a result, more than a third of the world’s websites have not been updated, and are vulnerable to this exploit.

Fortunately the same AI tools that are finding these vulnerabilities are the same ones that can help us update our systems.

Technical debt needs to be called “critical maintenance” and taken far more seriously.

Put money aside for this in your next budget, and each one after that. You don’t want your customers driving around on bad tyres.