In late October, the PHP2Shell vulnerability exposed critical security flaws across millions of websites, including NASA and the White House, putting WordPress and Drupal sites at risk. Cybersecurity researchers discovered the exploit and reported it to the PHP Foundation before malicious actors could act. However, the incident serves as a warning sign for the age of AI, highlighting the exposure of legacy software written over the past 40 years.
Matt Suiche of Tolmo notes that the time has come to pay off this accumulated technical debt. The underlying bug, reported to the PHP Foundation in 2024, caused out-of-memory errors that were historically dismissed as minor crashes. Suman Jana of Columbia University explains that AI has become exceptionally good at the specific, painful reasoning required to exploit such bugs, transforming non-critical errors into critical vulnerabilities.
Earlier this year, Calif, sponsored by Open AI, used AI tools to find a way to run arbitrary code on host servers via the memory bug. While exploiting the flaw requires detailed system knowledge, AI is lowering the barrier for attackers below the 0.1 percent expert threshold. Following disclosure, a team of four engineers spent two months developing a patch, navigating the fundamental asymmetry of fixing bugs without breaking existing functionality.
The resolution underscores the growing role of AI tools and formal verification in securing open-source infrastructure against long-standing memory errors.
Source: Hacker News · Summarized by HeadlinesBriefing