AI Weaponizes Old PHP Bug

United StatesAI turned an ignored PHP crash bug into a critical exploit.

PHP2Shell put sites running WordPress or Drupal at risk, including NASA’s and the White House’s.

A researcher at Calif, aided by AI, used an out-of-memory error to run arbitrary code on servers within two weeks.

“Now it is time for the technical debt to be paid off,” said Matt Suiche, Tolmo’s AI security research lead.

Columbia’s Suman Jana says every project carries a backlog of crash reports few maintainers take seriously.

How each outlet framed it

drawn from 250+ reports worldwide

Hacker News: frames PHP2Shell as the AI-era reckoning for 40 years of legacy code, quoting Tolmo's Matt Suiche on technical debt