PHP2Shell Won't Be the Last Big AI Cybersecurity Risk

Tracy Alloway and Joe Weisenthal open by explaining that the episode was recorded on October 29 during what Joe calls “Black October.” Tracy initially assumes the phrase refers to falling stock markets, but Joe says it refers to a series of cybersecurity problems rather than market declines. The most prominent example is a set of vulnerabilities in PHP, an open-source programming language that they say is used by roughly 70% of websites. The unusual feature is that AI helped researchers uncover the vulnerability, raising the central question of whether AI will make the internet safer by helping defenders find flaws or more dangerous by helping attackers exploit them. Joe says he knows very little about cybersecurity, including what cybersecurity companies sell or how a customer can tell whether a security product is working when the absence of a successful hack may be the only evidence. He jokes that hackers are now taking notes because he does not use a VPN and avoids putting account information into his coding projects. Both hosts nevertheless say the increase in compromise notices is real: users are receiving more emails telling them that a service was breached and advising them to refresh keys or take other steps. They introduce Calif CEO Thai Duong and engineer Bruce Dang, whose careers and work on the PHP vulnerability will provide the episode’s answer.

Bruce Dang says he began his career nearly 20 years ago at Microsoft’s Security Response Center, the team associated with Microsoft’s monthly “Patch Tuesday” releases. He helped reverse-engineer Stuxnet, the publicly known malware associated with the sabotage of Iran’s nuclear program. He later worked at Apple on iOS security before Thai Duong persuaded him to join what Bruce jokingly calls “the Church of AI.” Duong explains that his own work includes breaking security protocols. One example involved SSL 3.0, an older protocol originally associated with Netscape. Duong and colleagues showed that SSL 3.0 could allow attackers to recover protected information, helping push the internet away from continued use of the protocol. He also describes a vulnerability caused by compressing data before encrypting it. Compression reveals how much redundancy is present, while encryption does not hide the length of the resulting message. If a user concatenates a secret such as a password with attacker-controlled text, an attacker can repeatedly vary the text, observe changes in compressed-and-encrypted length, and eventually recover the secret. Duong says he had been taught that compression before encryption was the correct order, but research later showed that assumption was wrong. After moving from Saigon to Mountain View in 2011, Duong worked at Google for 12 years, helping teams find vulnerabilities in products such as Gmail and Chrome before public release. He then left to create Calif. The guests frame their work as offensive security performed for defensive purposes: they hack systems to show maintainers what can be fixed.

Asked whether AI creates a fundamentally new cybersecurity risk, Duong says it is both a continuation and an acceleration. Systems have always contained vulnerabilities, and security engineers have always tried to find and exploit them. AI changes the speed and scale. He contrasts Microsoft’s roughly 20 monthly updates two decades ago with roughly 1,400 updates per month today, saying the number will continue to grow. A task that once required many people and three months may now take one person and a capable AI model only a few days. The hosts then ask how Calif discovered the PHP vulnerability. Duong says Calif joined OpenAI’s “Cybersecurity Grant” or similar funding program for helping open-source maintainers find, fix, and mitigate vulnerabilities. Calif engineer Ryan Osteen, a PHP historian, worked with the PHP Foundation after Calif’s Stefan Esser—known for earlier PHP security work—made the introduction. The project began around July 30, and within a day or two Osteen found a vulnerability related to a flaw Esser had disclosed 22 years earlier. The PHP Foundation told Calif that it had independently found the same underlying problem in 2024 but had not fixed it. The repair was expensive and could disrupt PHP functionality or introduce new bugs. The foundation therefore lacked a working exploit demonstrating that the issue could be used remotely. Calif supplied an exploit the next day, showing that an attacker who knew nothing about the target could hack a website remotely. Duong says AI was less important for locating the flaw in PHP’s enormous codebase than for turning a known or suspected issue into a practical exploit. AI let engineers describe the exploit they wanted and have the model help build and test it.

Joe asks whether defensive cybersecurity can stay ahead of offensive cybersecurity. Duong says he is optimistic that it can: AI could help defenders write more secure software and build systems that are harder to exploit. It can process data and provide feedback quickly, making it possible to experiment with defensive designs. Dang adds that attackers usually adopt new tools earlier, but there are more legitimate defenders than attackers, so defenders can eventually catch up. The guests compare cybersecurity with securing a house that has many doors and must remain open for business. Every entry point has to be protected without shutting down the organization. They argue that cybersecurity has made substantial progress over the past 25 years; the continuing stream of breaches does not mean that no progress has occurred, because conditions would be much worse without those improvements. Joe suggests that the current period may simply be an awkward phase in which AI is exposing old “technical debt.” In that optimistic scenario, AI finds legacy vulnerabilities, organizations pay down the debt, and the resulting systems become more resilient. Duong says that interpretation is only partly reassuring. Calif has found that systems believed to have received years of security investment can still contain roughly ten times more bugs than expected. Chrome is his striking example: Google had invested heavily both in eliminating vulnerabilities and in adding mitigations that made remaining flaws harder to exploit, yet AI-assisted work still uncovered about a thousand vulnerabilities. The guests say the problem is not limited to obviously neglected projects such as PHP.

Joe asks whether a browser or other large program could ever be provably secure, in the way a mathematician proves a theorem. Duong and Dang say formal verification exists for small software components, and it may be part of the path toward more secure systems, but it does not currently scale to something as complex as a browser. A browser is effectively its own operating system, and Chrome has billions of lines of code and a large team devoted to its security. Even when a core component is formally verified, applications running on top of it can still contain vulnerabilities. Duong gives a deeper reason for the difficulty. Software succeeds partly because it is easy to change: companies can modify products overnight, respond to feedback, and adapt faster than other industries. A requirement to formally verify every change would slow that process and conflict with the commercial reason software companies are so effective. Formal verification might become practical if AI could automate it, but without that assistance it would be too slow for software that changes constantly. The hosts also discuss whether AI systems can simply be instructed not to hack. Duong rejects that as an overly simple answer. A model that is good at coding, debugging, controlling computers, and automating technical work necessarily has capabilities that resemble hacking. Companies make money by selling tokens for coding and other knowledge work, so they cannot easily make the model capable of coding while removing every capability associated with cyber offense. Security products themselves are not automatically secure; as Duong puts it, “product security is not the same as security product.”

Dang explains that the old distinction between zero-day vulnerabilities and disclosed, or “end-day,” vulnerabilities is no longer sufficient. He introduces “minus-one-day” vulnerabilities: flaws that become exploitable as soon as a vendor’s patch is publicly posted. With open-source projects such as PHP, a patch appears on GitHub. An attacker monitoring the repository can compare the patch with the old code, infer the vulnerability, and use AI to produce an exploit before ordinary users have installed the update. In the past, attackers often had to wait for a patch and then spend time developing an exploit, giving users a longer opportunity to upgrade. Now that interval is collapsing across Windows, macOS, PHP, Python, Java, and other important software. Dang says attackers can monitor these repositories and have AI immediately analyze a change, spend tokens on the task, and generate a usable exploit. Calif therefore believes the standard process of disclosure, patching, and user upgrades is under increasing pressure. He describes recent incidents that show how quickly the change is arriving. Calif has seen banking clients compromised in a way that used to take attackers about a month to spread through a network; in the newer incidents, attackers entered on Monday and were “everywhere” by Tuesday. OpenAI also reported seeing about 100 compromised points in a network during one incident, rather than the one or two points defenders might traditionally expect. Dang compares the present to chess and Go. After IBM’s Deep Blue defeated Garry Kasparov in 1997, it took about 10 years before software running on ordinary computers defeated the best humans without human assistance. After AlphaGo defeated Lee Sedol, that transition took roughly three years. Calif calls the current phase the era of the “centaur hacker,” in which the strongest attacker is a human expert working with AI. The guests do not know whether that phase will last three months, a year, or three years; they say AI may soon do even more of the work. Duong compares AI to fire: humanity must learn both how to control it and what useful, safe things to cook with it.

After the interview, Tracy says the discussion was fascinating but not uplifting. She had expected the guests to describe a temporary period in which AI exposed legacy weaknesses before being used to redesign systems into something more resilient. Instead, Duong and Dang said even heavily defended systems can contain far more vulnerabilities than expected, and that AI currently helps attackers more than defenders. Joe highlights several points: formally verified software is possible only for relatively small components; the human-AI “centaur” advantage may disappear quickly; and a model that is good at coding is difficult to prevent from being good at hacking. He returns to the irony that telling an AI coding system simply “not to hack” is not a complete solution, because hacking is closely connected to understanding and manipulating code and computers. The episode ends with the hosts’ practical conclusion that cyber risk is not a distant theoretical problem. AI is compressing the time required to find vulnerabilities, create exploits, and move through compromised networks, while patching and upgrading still depend on organizations acting before the attacker does. Tracy and Joe invite listeners to discuss the subject in the Odd Lots Discord and direct them to the related Bloomberg articles about AI-enabled cyberattacks and Japan’s rising cyberattacks.