IEEE Spectrum's Dina Genkina looks at PHP2Shell, the PHP flaw disclosed in late October that put sites running WordPress, Drupal and other PHP software at risk of data theft and remote code execution. The underlying memory bug had been reported to the PHP Foundation in 2024 but was treated as a mere crash. A researcher at the security firm Calif, auditing PHP with AI tools under OpenAI sponsorship, turned it into a working code-execution exploit within two weeks; Wiz confirmed and expanded the findings, and four PHP engineers spent two months on a patch. As far as anyone knows, it was fixed before attackers had the exploit.

"Now it is time for the technical debt to be paid off," says Matt Suiche of Tolmo. Columbia's Suman Jana describes an asymmetry: AI makes finding bugs easier, but fixes must close every path without breaking anything, which strains unfunded open-source maintainers. Johns Hopkins' Matthew Green expects little to change until something worse happens; meanwhile, he says, install updates promptly.