PHP2Shell Meltdown: AI Found It. Who's Going to Patch It?

October 24th, 2026

1 hr 52 mins 41 secs

Link with Timestamp

Download MP3 (155 MB)

Your Host
Tags
ai apt research cyberespionage nation-state ransomware zero-day

About this Episode

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem - Episode 117: This week, we dig into PHP2Shell, the AI-assisted PHP bug that led governments to take websites offline, and the arguments over broken embargoes, who found it first, and the AI doomers taking an "I-told-you-so" victory lap.

Plus, why patching hasn't kept up with AI bug finding, a failure of SBOMs, Terence Tao on math after AI, the iPhone Duo jailbreak and the eMudhra certificate authority key leak.

Cast: Juan Andres Guerrero-Saade and Ryan Naraine. Costin Raiu is traveling.

Timestamps:
0:00 Introductory banter
1:07 Black October's pile of critical bugs
2:34 PHP2Shell and the AI victory lap
8:28 Twenty years of PHP technical debt
16:54 Wiz, Gemini 4 Argon and the credit fight
21:01 Chainguard breaks the embargo
28:42 The doomers' warnings and the patching gap
39:32 Is this an SBOM problem?
55:33 Inside the PHP Foundation's post-mortem
1:03:13 Are bugs sparse or dense?
1:11:24 Should frontier labs fix coding?
1:20:14 Vibe coding and math's industrial era
1:27:26 Who pays to maintain open source?
1:44:59 iPhone Duo hacked already, eMudhra and the news

Episode Links