PHP2Shell Creates a New AI Security Service: Audit Decades-Old Legacy Code Before an AI-Assisted Attacker Finds the Exploit First

PHP2Shell is not just a vulnerability disclosure.

It is a preview of a service business.

What happened

In late October 2026, researchers disclosed a critical flaw in PHP — the language created in 1994 — that could let an attacker read sensitive data and execute code on servers running major sites, including NASA, Wikipedia, and the White House. It was patched before exploitation occurred.

Here is the part that matters for anyone selling AI services: the bug had been sitting in a bug tracker since 2024, filed as a minor "out-of-memory" crash — the kind of report that normally gets triaged and ignored.

Earlier this year, the cybersecurity firm Calif offered to independently audit PHP, sponsored by OpenAI. Within two weeks, a researcher at Calif, aided by AI tools, found a way to use that out-of-memory bug to run arbitrary code on the host server.

Fixing it took four engineers about two months.

The quote that explains why this is bigger than one bug

Matt Suiche, AI security research lead at Tolmo, put it plainly:

"All the legacy software written by humans over the last 40 years is being exposed. Now it is time for the technical debt to be paid off."

Suman Jana of Columbia University explained why AI is the thing that changed the math: "AI has done a very good job at painful, very specific reasoning" — the kind of reasoning it takes to chain a boring crash into a working exploit.

And Jana named the business problem directly: finding bugs and fixing bugs have a "fundamental asymmetry" — attackers need one path in, defenders have to close every path.

The service business hiding in this story

Every company still running code written before AI-assisted auditing existed has the same exposure PHP had: bugs that look minor because nobody has had the tooling, time, or top-0.1-percent expert talent to chain them into something dangerous.

That gap is exactly what AI coding tools close. And it is exactly what you can sell:

• A fixed-scope legacy code audit, using AI tools to re-triage old "minor" bug reports the way Calif re-triaged PHP's out-of-memory crash
• A remediation retainer for teams that don't have four engineers and two months to spend on a single fix
• A recurring re-audit, since each new AI model gets better at exactly the "painful, very specific reasoning" Jana described

Why now, not later

Matthew Green of Johns Hopkins gave this a deadline: "Nobody's going to fix this problem until something really bad happens... maybe sometime in early 2027."

That is a sales line, not just a prediction. It gives you a specific window to sell the audit before the incident that proves Green right.

Who to sell this to

• Companies running PHP, Perl, old Java, or C/C++ codebases older than ten years
• Teams with a backlog of "minor" bug reports nobody has prioritized
• Security leads who need a number to put in front of their board before "early 2027"

Bottom line

PHP2Shell proves AI didn't just get better at writing code. It got better at reading forty years of other people's code and finding what they missed. That is a service, not just a headline.

Source: https://spectrum.ieee.org/ai-in-cybersecurity-php2shell-vulnerability