The Pulse
AI Exposes 40 Years of Unpaid Software Debt
AI-assisted researchers turned a long-known PHP memory bug into PHP2Shell, a vulnerability that could expose sensitive data and allow code to run on affected servers. The case highlights the strain of finding and fixing security flaws in wi
AI.info Team · Written with AI · fact-checked ·
In late October, the PHP2Shell vulnerability put websites including NASA, Wikipedia and the White House at risk of data theft and malicious code running on their servers. Researchers reported the flaw to the PHP Foundation, and a patch was released before attackers got hold of the exploit. IEEE Spectrum published its account on 2 November, framing the episode as a warning about AI-assisted cybersecurity.
A crash bug became a route to server access
PHP, created in 1994, is widely used by legacy websites. The flaw behind PHP2Shell had been reported to the PHP Foundation in 2024, but it appeared to cause an out-of-memory error: a program crash that was not inherently dangerous. The report says that kind of bug can remain low on the list of fixes.
“One of the things we’re witnessing now is that all the legacy software that was written by humans over the last 40 years is being exposed,” says Matt Suiche, AI security research lead at Tolmo. “Now it is time for the technical debt to be paid off.”
AI helped Calif turn the flaw into an exploit
Earlier in 2026, cybersecurity firm Calif offered to audit PHP independently, with OpenAI sponsoring the work. Within two weeks, a Calif researcher using AI tools found a way to turn the out-of-memory bug into a means of running arbitrary code on a server. Calif alerted the PHP Foundation, and cybersecurity company Wiz confirmed and expanded the vulnerabilities.
Suman Jana, an associate professor of computer science at Columbia University, says exploiting the bug involved working out where to jump in a program’s memory and which bits to overwrite, and in what order. “It’s just that it’s a lot of very specific reasoning that is painful to do. And AI, I think, has done a very good job at that,” he says.
Jana cautions that AI did not do the work alone: the researchers had deep knowledge of cybersecurity and PHP. He says AI can help the top 0.1 percent of experts get more done, while enabling people just below that level to reach further without knowing every technical detail.
Finding flaws is easier than closing them
After the exploit was disclosed, four engineers spent two months developing a patch. Jana describes an imbalance between finding and fixing bugs: a fix must close every part of an attack without breaking existing functions. That burden is especially difficult for open-source software such as PHP, whose maintenance can be challenging without clear revenue streams.
Jana says frontier AI labs have donated some of their token budgets to investigate bugs and argues for more such support, through coordinated efforts or donations. He also points to formal verification tools as a way to help automate patching. He describes a system in which an LLM generates a patch and another LLM generates a proof that the patch is correct; a separate proof checker verifies it because LLMs can hallucinate.
Researchers disagree on what will prompt more investment
Matthew Green, an associate professor of computer science at the Johns Hopkins University Information Security Institute, is less optimistic. He says PHP2Shell was not severe enough to spur broad funding, and predicts that a worse incident affecting ordinary people could prompt it. Jana says PHP2Shell will not be the last such case and hopes white-hat hackers find the next vulnerability first.
Green’s immediate advice is to install security updates promptly when a phone offers one.