PHP2Shell shows AI is finding old bugs faster than teams can fix them

IEEE Spectrum looks at PHP2Shell, a critical PHP flaw disclosed in late October that put sites running WordPress, Drupal and other PHP software at risk. The underlying bug was reported in 2024 as a simple crash; during an OpenAI-sponsored audit, a researcher at security firm Calif, aided by AI tools, turned it into a way to run code on the server within two weeks. As far as anyone knows, the patch landed before attackers had the exploit, but it took a team of four engineers two months. Experts quoted say AI makes finding bugs much faster than fixing them, which puts extra strain on open-source maintainers. On Hacker News (1,030 points) the thread is split. The largest reply thread welcomes it, saying web developers have covered over root problems for years; another big one hopes it exposes zero-days that states and spyware firms have kept quiet. Several others argue AI-written code is creating new technical debt just as fast. No consensus. Sorted take: if you run WordPress or any PHP site, apply security updates the week they ship.