#php2shell · Cascadity

MVMaker Views #AI-security #Hacker-News #open-source #php #php2shell #technical-debt #vulnerability

IEEE Spectrum: the PHP2Shell flaw shows AI is exposing decades of old bugs faster than volunteers can fix them

A clear explainer of how a years-old crash bug became a critical exploit with AI help, and why defenders worry about the gap between finding and fixing.

IEEE Spectrum's Dina Genkina looks at PHP2Shell, the PHP flaw disclosed in late October that put sites running WordPress, Drupal and other PHP software at risk of data theft and remote code execution. The underlying memory bug had been reported to the PHP Foundation in 2024 but was treated as a mere crash. A researcher at the security firm Calif, auditing PHP with AI tools under OpenAI sponsorship, turned it into a working code-execution exploit within two weeks; Wiz confirmed and expanded the findings, and four PHP engineers spent two months on a patch. As far as anyone knows, it was fixed before attackers had the exploit.

"Now it is time for the technical debt to be paid off," says Matt Suiche of Tolmo. Columbia's Suman Jana describes an asymmetry: AI makes finding bugs easier, but fixes must close every path without breaking anything, which strains unfunded open-source maintainers. Johns Hopkins' Matthew Green expects little to change until something worse happens; meanwhile, he says, install updates promptly.

Read it at the source

IEEE SpectrumPHP2Shell Is a Wakeup Call for AI in Cybersecurity - IEEE Spectrum Independent ↗ Hacker NewsDiscussion: AI is forcing us to pay off 40 years of technical debt Independent ↗

Cascadic Analysis 2

UndertowAutonomous cyber capability scales attackers enormously

What hidden risk could pull against this, even if the news is good?

The bug was reported in 2024 and filed as a crash; a researcher auditing PHP with AI tools turned it into a working code-execution exploit within two weeks. Fixing it took four PHP engineers two months. Columbia's Suman Jana names the asymmetry: AI makes finding bugs easier, while fixes must close every path without breaking anything, and much of that work falls on unfunded maintainers.

UndertowDelayed Consequence / False Success Problem

What hidden risk could pull against this, even if the news is good?

This one went well: as far as anyone knows, PHP2Shell was patched before attackers had an exploit. A good outcome can be read as proof that the current setup works, and Johns Hopkins' Matthew Green expects little to change until something worse happens. Each near miss that ends well makes the next one easier to underfund, even as AI tools surface more old bugs at once.

Rabbit Holes 1

Technical debt

After exploring PHP2Shell Is a Wakeup Call for AI in Cybersecurity - IEEE Spectrum, for the idea in the headline, read about Technical debt.

Defines the future cost of maintaining a system that comes from choosing an expedient solution during development.

Wikipedia · Wade · 5 min

0

CCybersecurity #cisa #Palo-Alto-Networks #patch #php #php2shell #vulnerability

PHP2Shell moves from panic to real attacks: CISA confirms exploitation, and researchers trace 25 rooted firewalls

The Register lays out what is confirmed and what was walked back; Dream's report shows a full intrusion step by step.

New this week on PHP2Shell, the two critical PHP flaws patched on October 21: on Monday, October 26, the US Cybersecurity and Infrastructure Security Agency (CISA) added both (CVE-2026-109618 and CVE-2026-109619) to its catalog of exploited vulnerabilities and gave federal agencies until October 29 to patch, The Register reports. A Perplexity researcher logged successful shell commands on honeypots, while Sophos and Palo Alto Networks walked back earlier claims of successful attacks.

On October 28, Israeli security company Dream said it had recovered the tools of a suspected Chinese, apparently AI-assisted campaign that chained a custom PHP2Shell exploit with a Linux kernel bug (Fragnesia, CVE-2026-46300) to get root on 25 Palo Alto Networks PAN-OS firewalls and management servers in the US, Japan, Taiwan and South Korea. From a US government-affiliated firewall, Dream says, the attackers moved into the internal network and went after Active Directory. Palo Alto's Unit 42 independently verified the tooling, and Palo Alto is releasing fixed PAN-OS versions.

Admins are told to move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and to keep management interfaces off the internet.

Read it at the source

The RegisterCISA confirms PHP2Shell under attack as researchers clock successful exploits Independent ↗ DreamChained PHP2Shell Exploit Roots 25 Servers | Dream Research ↗ The RegisterSuspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers Independent ↗

Rabbit Holes 1

PHP

After exploring CISA confirms PHP2Shell under attack as researchers clock successful exploits, why one language's bug reaches so far is clearer from PHP.

An overview of PHP, the general-purpose scripting language geared toward web development that much of the web still runs on.

Wikipedia · Wade · 5 min

0