# IEEE Spectrum — PHP2Shell shows AI is forcing us to pay off old technical debt

> Finding old bugs with AI is now faster than fixing them, and PHP2Shell is the first big proof.

- Org: IEEE Spectrum
- Date: 2026-11-02
- Category: article, security
- Source: https://spectrum.ieee.org/ai-in-cybersecurity-php2shell-vulnerability
- Canonical page: https://ai-tldr.dev/releases/ieee-spectrum-php2shell-technical-debt/

## In short

IEEE Spectrum's Dina Genkina argues the PHP2Shell flaw is an early warning: AI tools now expose decades of neglected bugs in old software faster than teams can fix them. A 2024 low-priority PHP crash became a critical exploit.

## What it is

Dina Genkina's IEEE Spectrum piece uses PHP2Shell, the PHP flaw disclosed in late October 2026, to argue that AI-assisted bug hunting is exposing 40 years of neglected legacy code. The bug began as an out-of-memory crash reported to the PHP Foundation in 2024 and treated as low priority.

## How it works

The article traces the escalation: in an OpenAI-sponsored audit of PHP, a Calif researcher aided by AI tools turned the old crash into arbitrary code execution within two weeks, and Wiz confirmed and expanded the findings. A patch shipped before attackers used it, but it took four engineers two months to build. Columbia's Suman Jana describes one way out: an LLM writes the patch, another LLM writes a proof, and a non-LLM checker verifies it.

## Why it matters

The quoted experts describe an imbalance defenders now face: AI finds bugs faster than humans can patch them safely. Matt Suiche of Tolmo says the technical debt of human-written software must now be paid down, while Johns Hopkins' Matthew Green expects little new investment until a much worse incident, possibly in early 2027, and tells users to install updates promptly.

## Who it's for

security engineers, open-source maintainers, platform teams

## Links

- [Article](https://spectrum.ieee.org/ai-in-cybersecurity-php2shell-vulnerability)
- [HN Discussion](https://news.ycombinator.com/item?id=50364336)
- [Wiz PHP2Shell Report](https://wiz.io/blog/php2shell-php-rce)