IEEE Spectrum says AI is exposing 40 years of legacy software debt

A piece in IEEE Spectrum is at 866 points on Hacker News today. Dina Genkina reports on AI and old software. Named researchers tell her the same thing. Old crash bugs are now becoming working remote code exploits. They become exploits faster than teams can patch them.

The story uses the PHP2Shell vulnerability as the example. It took a lot of sites offline last month. It forced out-of-cycle patches across Node.js, Python and Bun. The bug was reported to the PHP Foundation in 2024. It was treated as a crash. The firm Calif, sponsored by OpenAI, offered to audit PHP independently. A Calif researcher used AI tools on the audit. Within two weeks, the researcher found a way to turn the crash into an attacker-code path on the server. Four PHP engineers then spent two months patching it.

The quote the headline is from

Matt Suiche runs the security firm Tolmo. He is quoted in the piece. All the legacy software "written by humans over the last 40 years is being exposed", he tells Genkina. "Now it is time for the technical debt to be paid off."

Suman Jana is a Columbia University professor who works on program analysis. He tells Genkina why AI matters here. Many bug reports waiting to be fixed, he says, are "just crashes". Turning a crash into a real exploit is slow for a human. Jana says it needs a lot of very specific reasoning. AI, he says, "has done a very good job at that."

The side the attackers are on

Jana draws the problem the piece is built around. "There is a fundamental asymmetry in finding bugs and fixing bugs." Finding is now cheap. Fixing a patched dependency across millions of installs is not. Jana adds that the frontier model labs are helping. "These frontier labs are donating some of their token budgets to look into these bugs, which I think is great."

Matthew Green is a cryptographer at Johns Hopkins. He tells Genkina the warning has not landed. Nobody will fix this, he says, "until something really bad happens." PHP2Shell was not that event. Green dates the next failure of that size at "maybe sometime in early 2027".

What a team can do this week

The researchers do not argue AI patches the problem on its own. Jana is careful on this. "I'm not claiming that AI can do it all by itself. It clearly cannot." He adds that AI "is improving a lot". The top 0.1 percent of experts, he says, "can get a lot more stuff done" with it. For a team building software today, the direct read is a boring one. Install security updates to dependencies as soon as they come out. Then run a scan on older code. Especially memory-handling code in C, C++ or PHP. An attacker has a tool that turns a reported crash into an exploit in two weeks. The job is to close the hole first.

Jana sets the stake for everyone else in the closing line. "This won't be the last one for sure. It's just who finds it. Hopefully, the white-hat [hackers] find it first, like this one."

Source

AI in cybersecurity: the PHP2Shell vulnerability, IEEE Spectrum, by Dina Genkina. Hacker News discussion.