PHP2Shell Won't Be the Last Big AI Cybersecurity Risk

Summary of PHP2Shell Won't Be the Last Big AI Cybersecurity Risk

by Bloomberg

49m•October 30, 2026
Listen to Episode

Overview of PHP2Shell Won't Be the Last Big AI Cybersecurity Risk

This Bloomberg Odd Lots episode examines how AI is reshaping cybersecurity, with a focus on a newly discovered PHP vulnerability nicknamed “PHP2Shell” and what it says about the future of internet security. Tracy Alloway and Joe Weisenthal speak with Taiyun and Bruce Dang of Calif, the security firm that helped uncover the flaw alongside Wiz, to discuss how AI is accelerating both offensive hacking and defensive discovery, shrinking the time between a patch being released and an exploit being created.

Key Takeaways

  • AI is speeding up both sides of cybersecurity

    • It helps defenders find vulnerabilities faster.
    • But it appears to help attackers even more right now by rapidly turning known issues into working exploits.

  • The most dangerous part of AI cybersecurity risk is the collapsing patch window

    • The gap between “vulnerability disclosed” and “real exploit in the wild” is shrinking dramatically.
    • The episode describes this as a move toward “minus-one-day” vulnerabilities—attackers can exploit issues almost as soon as patches are public.

  • Security debt is a major problem

    • Legacy software and old design decisions remain a huge attack surface.
    • AI is exposing how much “technical debt” still exists across major systems, including software many assumed was already well hardened.

  • Defensive cybersecurity can still catch up, but not immediately

    • The guests are cautiously optimistic that AI can eventually help build more secure systems.
    • For now, though, offense has the advantage because attackers adapt faster than defenders.

The PHP Vulnerability and Why It Mattered

How the issue was found

  • Calif joined OpenAI’s security research / “bug bounty”-style program aimed at helping open-source maintainers find and fix vulnerabilities.
  • A Calif engineer, Ryan Osteen, dug into PHP’s codebase and found a serious flaw.
  • The team then worked with the PHP Foundation to validate and disclose the bug responsibly.

Why PHP was such a big deal

  • PHP still powers a huge share of websites.
  • The vulnerability was significant because it could affect a large part of the internet, not just a niche system.
  • The PHP Foundation had reportedly seen a similar issue earlier but had not fixed it because:
    • the fix would have been expensive and complex,
    • it risked breaking existing functionality,
    • and they didn’t yet have a convincing exploit demonstrating real-world danger.

Why the disclosure sparked debate

  • Calif and partners publicized the issue before it was broadly fixed, which drew criticism.
  • Their argument: once they had proof of exploitability, it was important to warn the ecosystem and force action.
  • The episode frames this as a classic security tradeoff: responsible disclosure vs. the need to move fast when a flaw is serious and widely exploitable.

How AI Changes the Cybersecurity Playbook

What AI is best at today

  • Finding patterns in large codebases.
  • Speeding up reverse engineering.
  • Turning a known flaw into an exploit much faster than a human team could.
  • Assisting with complex exploit development that once required many specialists and weeks or months.

What the guests say is different now

  • In the past, hackers often needed lots of time and deep manual work to weaponize a bug.
  • Today, a skilled human plus a powerful AI model can do in days what used to take a team much longer.
  • The guests describe the current era as one of “centaur hackers”: the strongest attacker is often a human working together with AI.

A striking example

  • The guests say they’ve seen AI-driven intrusions in banking environments where:
    • one side of the network was compromised on Monday,
    • and by Tuesday the attacker had spread widely.
  • That kind of speed makes traditional detection-and-response models much less effective.

Can Defensive Cybersecurity Stay Ahead?

The optimistic case

  • Yes, in principle.
  • AI can also help defenders:
    • write more secure code,
    • analyze systems faster,
    • and potentially automate parts of formal verification.

The practical problem

  • Most real-world software is too large and constantly changing.
  • Browsers, operating systems, and major enterprise software are far too complex to make fully “provably secure” in today’s environment.
  • Software companies also have strong incentives to keep shipping and updating quickly, which makes perfect security unrealistic.

Main conclusion

  • The guests believe defense can eventually improve, but today AI is giving attackers the bigger advantage.
  • The best near-term hope is not perfect security, but better tooling, stronger mitigations, and faster remediation.

Notable Ideas and Concepts

“Product security is not the same as security product”

A security tool may itself have vulnerabilities. Buying a “security solution” does not automatically make a system safe.

Formal verification has limits

  • In theory, some software can be mathematically proven secure.
  • In practice, this only works well for small components—not for something as complex as a modern browser or large platform.

Not all “legacy” systems are equally safe

  • Even heavily scrutinized systems can still contain surprising numbers of vulnerabilities.
  • The episode suggests that some codebases believed to be relatively mature may still hide far more problems than expected.

Bottom Line

The conversation argues that PHP2Shell is not an isolated event—it’s a preview of what AI will do to cybersecurity more broadly. AI is compressing the time required to discover, understand, and weaponize vulnerabilities. That’s bad news for defenders in the short run. Over time, AI may also help build stronger systems, but for now the episode’s core message is clear: the attack surface is growing faster than most organizations can respond to it.