Technology
PHP2Shell vulnerability exposed legacy software flaws amid AI-driven discovery
Hacker News reports the PHP2Shell flaw put sites including NASA and Wikipedia at risk, and a four-engineer team spent two months on a patch.
The short version
- Hacker News reports that the PHP2Shell vulnerability put websites including NASA, Wikipedia and the White House at risk of data exposure and malicious code execution.[Hacker News]
- The underlying PHP bug was reported to the PHP Foundation in 2024, and a four-engineer team spent two months developing a patch.[Hacker News]
- Matt Suiche and Suman Jana say AI is accelerating the discovery of decades-old software flaws, which they describe as accumulated technical debt.[Hacker News]
- Matthew Green forecasts that funding for fixes may follow only a serious incident, possibly around early 2027.[Hacker News]
Key facts
- The PHP2Shell vulnerability put websites including those of NASA, Wikipedia and the White House at risk of exploits that could read sensitive data and run malicious code on the host server.[Hacker News]
- The bug underlying PHP2Shell was reported to the PHP Foundation as far back as 2024.[Hacker News]
- Earlier this year, the cybersecurity firm Calif offered to independently audit PHP, sponsored by OpenAI.[Hacker News]
- After the exploits were disclosed to the PHP Foundation, a team of four engineers spent two months developing a patch.[Hacker News]
- Anthropic released new formal verification tools to automate patching on October 22, according to the report.[Hacker News]
What remains uncertain
- The reporting does not establish whether the vulnerability was exploited before the patch was developed.[Hacker News]
- Views that AI is exposing legacy software at scale, and forecasts of a serious incident around early 2027, are expert opinions and predictions rather than established facts.[Hacker News]
Sources
Outlet counts describe coverage, not independent confirmation. Reports may share a wire service or original source.