IEEE Spectrum · 2026-11-02 · notable
IEEE Spectrum — PHP2Shell shows AI is forcing us to pay off old technical debt
IEEE Spectrum's Dina Genkina argues the PHP2Shell flaw is an early warning: AI tools now expose decades of neglected bugs in old software faster than teams can fix them. A 2024 low-priority PHP crash became a critical exploit.
Finding old bugs with AI is now faster than fixing them, and PHP2Shell is the first big proof.
What is it?
Dina Genkina's IEEE Spectrum piece uses PHP2Shell, the PHP flaw disclosed in late October 2026, to argue that AI-assisted bug hunting is exposing 40 years of neglected legacy code. The bug began as an out-of-memory crash reported to the PHP Foundation in 2024 and treated as low priority.
How does it work?
The article traces the escalation: in an OpenAI-sponsored audit of PHP, a Calif researcher aided by AI tools turned the old crash into arbitrary code execution within two weeks, and Wiz confirmed and expanded the findings. A patch shipped before attackers used it, but it took four engineers two months to build. Columbia's Suman Jana describes one way out: an LLM writes the patch, another LLM writes a proof, and a non-LLM checker verifies it.
Why does it matter?
The quoted experts describe an imbalance defenders now face: AI finds bugs faster than humans can patch them safely. Matt Suiche of Tolmo says the technical debt of human-written software must now be paid down, while Johns Hopkins' Matthew Green expects little new investment until a much worse incident, possibly in early 2027, and tells users to install updates promptly.
Who is it for?
security engineers, open-source maintainers, platform teams