The PHP2Shell vulnerability shows how AI is changing the cybersecurity risk posed by decades-old software. A memory-allocation bug in PHP, reported in 2024, was initially treated as a routine crash rather than a serious threat. In an audit sponsored by OpenAI, researchers at cybersecurity firm Calif used AI tools to turn it into a way to run arbitrary code on vulnerable servers, potentially exposing sensitive data or enabling malware. The affected software underpins many websites, including systems such as WordPress and Drupal. Researchers disclosed the issue before attackers exploited it, and the PHP Foundation released a patch after four engineers spent two months preparing one.
The episode illustrates a widening imbalance: AI can help specialists find and exploit complex bugs faster, while safely fixing them requires ensuring every attack path is closed without breaking existing software. AI does not replace cybersecurity expertise, but it lets leading researchers work more efficiently and may help less-specialized people reach that level. The discussion points to two responses: fund maintainers of widely used open-source projects and give defenders access to advanced security models; and develop formal verification tools that can check AI-generated patches. One researcher is optimistic that this work can become increasingly automated, while another warns that substantial investment may only follow a major public-facing breach. The practical advice is to install security updates promptly. PHP2Shell, the researchers warn, is likely an early example of AI exposing vulnerabilities accumulated across decades of software development.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Layer3 Intel detected 236 residential-proxy exits across six IP addresses on the White House network over 26 days, with independent services confirming the addresses. The activity’s evening pattern may point to an infected device, but the data does not identify a device or user; vulnerable proxy software could expose internal systems. (layer3intel.com)
Starting with version 27.3, Apple will check iCloud content shared through “Anyone with the Link” for harmful material, and those items will no longer be end-to-end encrypted. Apple can remove flagged content, restrict accounts, or involve law enforcement. (support.apple.com)
Flock Safety replaced a license plate camera in Plymouth, Minnesota, after the city canceled its contract and the police chief unplugged the device. The police chief said the department did not know about the replacement and sent staff to investigate. (thedrive.com)
Chrome will stop trusting new TLS certificates issued under eMudhra’s emSign Root CA G1 in Chrome 153 and later if their earliest timestamp is after November 16, 2026. Google cited eMudhra’s failure to adequately explain weak key generation that exposed eight subordinate CA private keys; older certificates and explicitly trusted certificates are unaffected. (groups.google.com)
The Kyiv Independent said hackers breached one of its systems and sent readers a fake warning about a nuclear attack on Kyiv. The outlet said attackers also tried to post false messages on its website and is strengthening security; the claims in the email were untrue. (hromadske.ua)
MCP servers face a tradeoff: strict redirect-URI allowlists block users’ own clients, while accepting arbitrary redirects enables OAuth phishing that can steal storage access. Stream Vessel describes a way to let users authorize custom clients without weakening redirect protections. (streamvessel.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.