Safety#Security scan#AI safety
IEEE Spectrum: AI is forcing the industry to pay off 40 years of technical debt
IEEE Spectrum's Nov 2 analysis: AI turns long-dismissed crash bugs into working exploits — PHP2Shell is the first bill, and finding now outpaces fixing.
On November 2, IEEE Spectrum published an analysis by computing and hardware editor Dina Genkina with a blunt thesis: AI has turned forty years of dormant software bugs into practical attack material. Crash bugs that maintainers long dismissed as harmless can now be chained into working exploits within weeks, and PHP2Shell was the first full demonstration. The piece reached Hacker News on November 4 under the title “AI is forcing us to pay off 40 years of technical debt,” and by late evening UTC it held 942 points and 576 comments — an incident-response story has turned into an industry retrospective.
Key points
- The article’s core fact chain: an out-of-memory bug reported to the PHP Foundation in 2024 was shelved as a harmless crash; a Calif researcher, aided by AI tools, turned it into arbitrary code execution in about two weeks. The fix took four engineers two months.
- Suman Jana of Columbia University compresses the industry’s position into one line: there is a fundamental asymmetry between finding bugs and fixing them, and AI cut the cost of only one side.
- Matthew Green of Johns Hopkins is the piece’s pessimist: nobody pays down this debt until something catastrophic happens, and he expects that event to arrive around early 2027.
Background
PHP2Shell is the industry name for two unauthenticated remote-code-execution flaws PHP patched on October 21 — CVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2 — and we covered the patch-day chaos, and the contradictory in-the-wild claims, in PHP ships two 9.2 RCE fixes. On October 26, CISA added both CVEs to its Known Exploited Vulnerabilities catalog and gave US civilian federal agencies until October 29 to remediate (see CISA confirms in-the-wild PHP2Shell exploitation). What the Spectrum analysis adds is distance: the question is no longer how to patch this one hole, but how many more like it exist and who pays to clear them.
The facts
The analysis rests on a timeline you can check piece by piece. PHP started life in 1994 as “Personal Home Page.” In 2024, a researcher reported an out-of-memory error to the PHP Foundation — allocated memory too small for the data, so programs crash, but nobody believed it could become an attack. Earlier in 2026, the security firm Calif audited PHP with OpenAI’s sponsorship, and within roughly two weeks one researcher, working with AI tools, converted that “harmless crash” into arbitrary code execution on the host server. The hard parts were jumping to a specific point in memory and deciding exactly which bits to overwrite in what order — exactly the kind of tedious, specific reasoning AI handles well. The exposure list included NASA, Wikipedia, the White House, and everything running WordPress or Drupal; Wiz confirmed and extended the findings.
| Date | Event |
|---|---|
| 1994 | PHP created, originally “Personal Home Page” |
| 2024 | OOM bug reported to the PHP Foundation; shelved as harmless |
| 2026-08-11 | Calif researcher reports unconditional RCE, found in about two weeks with AI |
| 2026-10-21 | PHP ships four patched releases; the fix took 4 engineers about 2 months |
| 2026-10-26 | CISA adds both CVEs to KEV, due 10-29 |
| 2026-11-02 | IEEE Spectrum publishes the analysis |
| 2026-11-04 | Story hits HN; 942 points and 576 comments as of 21:00 UTC |
One discrepancy in framing is worth spelling out. The article says the flaw was patched before criminals exploited it, while CISA has formally confirmed in-the-wild exploitation. Both stand: the KEV listing rests on a honeypot-confirmed RCE and AWS telemetry of attempts dating to October 17, and no attributable major breach appears in the public record. “No catastrophic incident” and “nobody tried” are different claims.
What others say
Matt Suiche, AI security research lead at Tolmo, hands the piece its thesis line: “all the legacy software that was written by humans over the last 40 years is being exposed,” and “Now it is time for the technical debt to be paid off.” Suman Jana, associate professor of computer science at Columbia, supplies the mechanism: bug finding is “not really rocket science… it’s a lot of very specific reasoning that is painful to do. And AI, I think, has done a very good job at that.” People just below the top 0.1 percent of experts can now succeed where they previously could not — though “I’m not claiming that AI can do it all by itself. It clearly cannot.” His remedies: frontier labs donating token budgets to hunt bugs in open source (OpenAI’s sponsorship of the Calif audit is the precedent), and Anthropic’s October 22 release showing the other half of the pipeline — “The patch is LLM-generated, and then an LLM generates the proof that the patch is correct.” Only the proof checker is not an LLM, “because LLMs hallucinate.”
The strongest counter-view comes from Matthew Green of Johns Hopkins’ Information Security Institute: “Nobody’s going to fix this problem until something really bad happens… PHP2Shell wasn’t bad enough to be really bad.” He predicts a crisis affecting ordinary people around early 2027, after which “We’re going to fund everything.” Until then, his advice is simply to install security updates immediately: “Just do it.” The HN thread splits the same way. ryandrake argues LLMs finally supply enough eyeballs for Linus’s Law to work; the top comment, from swatcoder, asks whether this is debt repayment at all or “a compulsory endless treadmill of feature-neutral fix-work”; ChuckMcM reports from practice that AI-generated fixes break something else more than half the time, so remediation stays mostly human for now; lelanthran puts it as “every line of code is a liability” and points to the Brotli flaw sitting inside nearly every server (see OpenAI’s red team found a Brotli RCE).
Our take
The practical reading for developers is about resource allocation, not panic. AI has collapsed the cost of the finding side; the bottleneck has moved to fixing — two weeks to an exploit chain, two months to a patch, and that gap is the debt Suiche is talking about. Teams running old dependencies should assume patch windows are measured in hours, as CISA’s three-day federal deadline already implies, and the funding problem for open-source maintainers has gone from chronic to pressing, as the article puts it. Two things stay open. Whether Anthropic’s formal-verification route scales is a claim without published numbers yet. And Green’s crisis prediction and the HN treadmill reading can both be true at once: the debt will never be fully paid, but individual debts are genuinely being cleared — betting on a single ending is the lazy option.