AI forces paying off 40 years of technical debt
The gist
An OpenAI-sponsored audit used AI to find a flaw letting attackers run code on servers running PHP.
The bug sat unreported since 2024, showing how much old code AI can expose.
How it unfolded
- 2024The bug underlying PHP2Shell was reported to the PHP Foundation; it caused an out-of-memory error and remained unaddressed.
- 2026Calif, sponsored by OpenAI, offered to audit PHP; within two weeks a researcher aided by AI tools found a way to run arbitrary code on the host server.
- Late October 2026A slew of major cybersecurity issues came to light, the biggest being PHP2Shell, which put sites including NASA's, Wikipedia's and the White House's at risk.