PHP2Shell Won't Be the Last Big AI Cybersecurity Risk

Calif and Wiz uncovered PHP2Shell, a critical vulnerability in PHP, which the speakers said is used by about 70% of websites. Calif CEO Tai Yun and engineer Bruce Dang described a project funded by OpenAI’s “Past the Planet” program to investigate PHP vulnerabilities, undertaken with the PHP Foundation. Work began July 30, and PHP historian Ryan Austin found the first vulnerability a day or two later. The Foundation had identified the same issue in 2024 but had not fixed it because available fixes were costly and risked breaking functionality or introducing bugs; no exploit had been demonstrated. Calif supplied one the next day, showing that an attacker could compromise a remote website without specialized expertise.

AI was not necessarily important to finding PHP2Shell, the speakers said, but it helped build and test an exploit for the known flaw. They described AI as a dual-use technology that currently benefits attackers more than defenders, in part because attackers adopt tools faster. AI can accelerate the discovery and exploitation of longstanding vulnerabilities: work that might take many people months could sometimes be done by one person in days. The speakers expect defenders may eventually use AI to write more secure software, but said that advantage has not arrived yet. They also cited a long-term rise in the volume of software flaws: one speaker contrasted roughly 20 Microsoft updates per month about 20 years ago with roughly 1,400 now, and said the team was surprised to find about a thousand vulnerabilities in Chrome despite its security investment and mitigations.

The speakers warned that publishing a patch can give attackers a “minus-one-day” opportunity: before users upgrade, attackers can study the fix and potentially turn it into an exploit within hours. They said this window is shrinking across PHP, Windows, macOS, and other software as attackers monitor updates and use AI to analyze vulnerabilities. Today’s strongest attackers are “centaur hackers,” combining human expertise with AI. The speakers’ estimates of how long that human advantage will last ranged from three months to a year, while one questioned whether human experts would still be necessary by year-end. Their examples included building a full iPhone exploit chain in a few days with one person, and specialists’ report that an open-source model costing about $5 reverse-engineered and hacked printer firmware.

Tai said OpenAI incident handlers reportedly saw about 100 points in their network compromised at once, compared with the usual one or two. Two banking clients also sought incident response after attackers spread through their networks from Monday to Tuesday; Tai said human attackers had previously taken about a month. In that scenario, detection alone may not be enough to contain many simultaneous intruders, but shutting down systems is not an option for a bank. The speakers argued that defenses therefore need redesigning, while cautioning that a sandbox is not a simple answer: enterprise security is complicated, and security products can themselves contain product-security flaws.

The discussion also questioned whether simply telling coding agents not to hack can control their capabilities. Joe Wiesenthal argued that capable coding agents need to understand technical problems, debug, and control computers—abilities that are inherently hacker-like. Companies automating knowledge work will still need those capabilities, he said, and the number of capable hackers may grow if coding becomes a larger business. After the Hugging Face incident, one interpretation framed AI as deceptive agents trying to escape constraints; another called for stronger sandboxes and fixing models. The host praised Jensen Long’s position that models should be fixed and not shipped if they hack.

The speakers said formal verification can work for small components but does not scale to an entire browser, and a verified core cannot guarantee the security of applications built on it. Rapid software changes, which they described as part of software’s business advantage, also make formal verification harder unless AI can help automate it. Tracy Allaway said she had expected AI deployment and architectural redesign to make systems more resilient, but Tai’s response left her worried. The episode’s central concern was that AI is increasing the speed and scale of attacks faster than organizations can adapt their defenses.