Imagine running a shop and discovering that the locks fitted across your entire street have the same weakness.

You did not leave the door open. You trusted a lock that everyone else trusted too.

That is the uncomfortable part of PHP2Shell, a set of serious security flaws disclosed this week in software underneath much of the web. Researchers used AI to help find the weaknesses and turn them into working exploits. Fixes arrived on October 21. Wiz’s research

My take: AI is changing which old software weaknesses attackers can realistically use. We need to take the maintenance of the internet much more seriously.

I am Alex. Welcome to ShortCu8 by Innov8.

Lets Dive Deep.

PHP is a programming language used behind websites, including those built with WordPress and Drupal. You do not need to know its name to depend on it.

The reported flaws were in PHP itself. Depending on the flaw and setup, an attacker could run code on an affected server without logging in, or read sensitive information from its memory. A website’s own application code could be secure and still sit on vulnerable software. What Wiz found

That changes how I think about “my website is secure.” Who is checking the layers underneath it?

The bugs had survived for years. Wiz says AI helped researchers do the difficult work needed to turn them into working attacks across different applications. Its team used models from Google and OpenAI during the research. The research process

A weakness being complicated to exploit used to buy defenders some breathing room. My concern is that we can depend on that less as the tools improve.

The important detail in this story is who used the AI.

Researchers working to secure the software found the vulnerabilities. OpenAI says Calif identified a critical flaw using GPT-5.6 Sol, while Wiz independently discovered and reported both vulnerabilities. PHP’s maintainers led the fixes. The coordinated response

OpenAI says that, to its knowledge, the discoveries preceded attackers finding them. That gave the teams time to prepare protections before making the details public.

Cloudflare also says it deployed firewall protections ahead of public disclosure. Those protections can help shield sites, but operators still need to apply the relevant software updates. Cloudflare’s response

It also reported attack traffic after details leaked before the official release, with attackers changing their attempts to try to bypass protections. That makes the patching race very real. What Cloudflare observed

So this is a real reason to use AI for defence. We should want the people maintaining essential software to have the strongest tools available.

Finding a bug is only part of the job, though. Someone has to develop a fix, check it, distribute it and get it running on the systems that need it. OpenAI’s account describes two months of coordination around these flaws. Why the response took work

Making discovery faster does not automatically make that whole process faster.

Another incident this week shows why the problem reaches beyond finding bugs.

LiteLLM, software used to connect applications to AI models, reported that attackers compromised its release process. Version 1.107.0 contained malware that stole credentials and supported remote code execution. The affected packages and container images were subsequently removed or replaced. LiteLLM’s incident report

Someone could have obtained the malicious software through the normal channels they trusted for updates.

That report does not establish that AI carried out the attack. I would not bundle every breach into “AI broke the internet.”

What connects the stories is our dependence on shared software and the people responsible for keeping it trustworthy. In one case, old code contained dangerous flaws. In the other, attackers interfered with how new software reached users.

The security of your app depends on more than what you wrote.

If you run a website, ask whoever manages its hosting: “Do we use PHP, and have the PHP2Shell fixes been applied to the version we actually run?”

Updating a WordPress plugin is not the same job as updating PHP underneath it. OpenAI has published a version-checking tool, and both its guidance and Cloudflare’s direct operators towards the relevant fixes. Operator guidance

If you used the affected LiteLLM release, follow its incident guidance. Replacing the package alone does not undo stolen credentials; the team advises rotating exposed secrets and rebuilding affected environments. Affected versions and response

For everyone else, this is a reason to ask better questions of the services you rely on. A list of frightening headlines cannot tell you whether your particular account or website was compromised.

I want to see the same enthusiasm for funding fixes and supporting maintainers that we see for building more capable AI.

We are improving the tools that can find weaknesses. The people responsible for fixing them need to keep up, and they need the resources to do it.

We read every reply - just reply to this email and let us know how we can improve !

#AD1

Your AI is only as good as what you feed it. Feed it a transcript with your product names, acronyms, and numbers spelled wrong, and you spend the afternoon hand-fixing the output.

Wispr Flow Notetaker uses your dictionary and calendar, so product names, acronyms, numbers, and uncommon names come out spelled right. It pops up when your meeting starts and captures Zoom, Google Meet, Teams, and Slack huddles with one click, no bot joining the call.

Then your meetings show up inside Claude or ChatGPT through the built-in connector. No copy paste. Try Notetaker free on Mac and Windows.

Try Notetaker Free

#AD2

New Harvard Business Review Analytic Services report: why most AI tools fail at B2B customer service, and what to ask before you invest. Get the free report.