Three Buddy Problem·Oct 24, 2026·1h 52m

PHP2Shell Meltdown: AI Found It. Who's Going to Patch It?

Download audio Show notes Apple Podcasts Spotify

Show notes

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem - Episode 117: This week, we dig into PHP2Shell, the AI-assisted PHP bug that led governments to take websites offline, and the arguments over broken embargoes, who found it first, and the AI doomers taking an "I-told-you-so" victory lap.

Plus, why patching hasn't kept up with AI bug finding, a failure of SBOMs, Terence Tao on math after AI, the iPhone Duo jailbreak and the eMudhra certificate authority key leak.

Cast: Juan Andres Guerrero-Saade and Ryan Naraine. Costin Raiu is traveling.

Timestamps:
0:00 Introductory banter
1:07 Black October's pile of critical bugs
2:34 PHP2Shell and the AI victory lap
8:28 Twenty years of PHP technical debt
16:54 Wiz, Gemini 4 Argon and the credit fight
21:01 Chainguard breaks the embargo
28:42 The doomers' warnings and the patching gap
39:32 Is this an SBOM problem?
55:33 Inside the PHP Foundation's post-mortem
1:03:13 Are bugs sparse or dense?
1:11:24 Should frontier labs fix coding?
1:20:14 Vibe coding and math's industrial era
1:27:26 Who pays to maintain open source?
1:44:59 iPhone Duo hacked already, eMudhra and the news

Links:

← Previous

Who's Hacking Supermarket Fridges in France?

( Presented by TLPBLACK : A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals. ) Three Buddy Problem - Episode 117 : This week, we dig into PHP2Shell, the AI-assisted PHP bug that led governments to take websites offline, and the arguments over broken embargoes, who found it first, and the AI doomers taking an "I-told-you-so" victory lap. Plus, why patching hasn't kept up with AI bug finding, a failure of SBOMs, Terence Tao on math after AI, the iPhone Duo jailbreak and the eMudhra certificate authority key leak. Cast: Juan Andres Guerrero-Saade and Ryan Naraine . Costin Raiu is traveling. Timestamps: 0:00 Introductory banter 1:07 Black October's pile of critical bugs 2:34 PHP2Shell and the AI victory lap 8:28 Twenty years of PHP technical debt 16:54 Wiz, Gemini 4 Argon and the credit fight 21:01 Chainguard breaks the embargo 28:42 The doomers' warnings and the patching gap 39:32 Is this an SBOM problem? 55:33 Inside the PHP Foundation's post-mortem 1:03:13 Are bugs sparse or dense? 1:11:24 Should frontier labs fix coding? 1:20:14 Vibe coding and math's industrial era 1:27:26 Who pays to maintain open source? 1:44:59 iPhone Duo hacked already, eMudhra and the news Links: Transcript PHP Foundation: How We're Strengthening PHP Security RCE via OOM corruption · Advisory RCE via stale global state · Advisory PHP2Shell by Calif Research Wiz: PHP2Shell: AI uncovers critical RCE vulnerabilities in PHP Chainguard CEO explains breaking PHP vuln embargo Alpha-Omega – Open Source Security Foundation OpenAI Daybreak: Patch the Planet VirusTotal: Sizing the PHP exposure window Mathematics in the age of AI 3Blue1Brown on YouTube There's never been a better time to go into math - YouTube Terence Tao Talks to Numberphile About AI Disgraced eMudhra drops out of TLS business Node.js Patches Brotli Remote Code Execution Flaw Max-severity GitLab bug allows remote code execution over 12 years of releases Inside the LiteLLM 1.107.0 supply chain compromise Calif hacks new hardware based UFP mitigation in the iPhone Duo CTI in Agentic Times (Costin/Vicente training) TLPBLACK