theresa

#PHP2Shell is a big one. Here are my takeaways. 1. These flaws reach back more than a decade. PHP’s maintainers identified one underlying problem in 2024, but its full impact wasn’t clear until AI-assisted research demonstrated its exploitability. What seems impractical to exploit today could easily be exploitable tomorrow as models advance. 2. Much of the web runs on PHP, and a lot of it is on versions that are out of support. Some get a source backport you must build yourself. Some get nothing. Attackers aren't hunting the servers you just patched. They're hunting the ones you forgot you own. There is going to be a very long tail on remediating these vulnerabilities, and we will see many downstream breaches over the coming months. 3. The patching window has completely collapsed. While we’ve exponentially found more vulnerabilities and exponentially created more patches, we’ve hit the sound barrier on operationally rolling them out. Even more concerning is the increase in exploitation occurring before or on the day of disclosure. When a flaw gets exploited, almost 90% of the time it’s hit on or before the day it’s disclosed. As defenders, you need to be looking at your watch, not a calendar! 4. Coordinated disclosure in open source is really hard. It runs on trust, not contracts. There were many people in the loop, and for good reason. Lots of great people doing incredible work. However, I expect leaked disclosures will be the norm, not the exception, as we move forward in the Agent-state era. The @a16z chart below says it all.