AI is forcing us to pay off 40 years of technical debt — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- PHP2Shell vulnerability exposed websites including NASA, Wikipedia, and the White House to remote code execution via an out-of-memory bug in PHP, a language dating to 1994, before being patched preemptively.
- Calif researcher, aided by AI tools and sponsored by OpenAI, discovered within two weeks that the long-ignored PHP memory bug could be weaponized to run arbitrary code on servers.
- Suman Jana of Columbia University noted AI excels at the 'painful' reasoning required to exploit complex memory vulnerabilities, amplifying the capabilities of top cybersecurity researchers.
- PHP Foundation engineers spent two months developing a patch after the AI-assisted discovery, highlighting the asymmetry between faster AI-aided bug discovery and slower, cautious patching.
- Anthropic released a new formal verification tool on 22 October that generates both LLM-written patches and proofs of correctness, with only the proof-checking step remaining non-AI to prevent hallucination errors.
- Matthew Green of Johns Hopkins warned that systemic fixes to legacy software risks won’t happen until a major public cyber disaster occurs, possibly by early 2027.
Why it matters: Open-source maintainers and widely used legacy systems like PHP now face heightened risk as AI lowers the barrier to discovering critical exploits, making proactive patching urgent despite limited funding—defenders must now match AI-powered attackers with equivalent tools or face inevitable breaches.
Ask SkimNews
