IEEE Spectrum on the PHP2Shell Vulnerability: A Warning for Cybersecurity in the AI Era

IEEE Spectrum reported on the PHP2Shell vulnerability, which affects websites running WordPress or Drupal, including those of NASA, Wikipedia, and the White House; it can read sensitive data and execute malicious code on servers. After discovering it, researchers reported it to the PHP Foundation and completed patching before it was exploited. Suman Jana of Columbia University believes that exploiting the vulnerability requires a great deal of tedious, specific reasoning, and that AI performs well in this regard but cannot complete it independently; he mentioned that a new tool released by Anthropic on October 22 allows LLMs to generate patches and have LLMs generate correctness proofs, with only the proof checker guaranteed by humans. Matthew Green of Johns Hopkins University judges that, until a more serious incident occurs, all parties will not truly invest in fixes.