PHP2Shell bug could have hit NASA, Wikipedia, White House

The PHP2Shell case traces back to a memory error reported to the PHP Foundation in 2024 but left unresolved because its severity was not recognized at the time. The language itself dates to 1994, when it stood for "Personal Home Page." In early 2026, an independent audit of PHP by Calif, a cybersecurity firm backed by OpenAI, used AI tools to show that the old memory bug could be exploited. Researchers found that leverage required precise, multi-step reasoning about memory locations and overwrite bits, a task where AI assistance proved effective, though the exploit still needed human experts knowledgeable in both security and PHP. The episode is being read as an early sign that AI can surface the accumulated technical debt of legacy software, and that the asymmetry between finding flaws and patching them without breaking existing features places a growing burden on open-source projects that lack a clear revenue source. Suggested responses include funding defenders and giving them access to advanced security AI models, along with progress in formal verification tools that automate patching. Anthropic's example of LLM-generated patches paired with LLM-generated proofs points in a promising direction, but hallucinations mean the final proof still needs human review. Some experts are pessimistic that nothing will be done until a truly serious incident occurs, while one thing is clear: cases like PHP2Shell are only the beginning, and whether they end in major damage or a quiet resolution depends on who finds the vulnerability first.