PHP2Shell Meltdown: AI Found It. Who's Going to Patch It?

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem - Episode 117: This week, we dig into PHP2Shell, the AI-assisted PHP bug that led governments to take websites offline, and the arguments over broken embargoes, who found it first, and the AI doomers taking an "I-told-you-so" victory lap. Plus, why patching hasn't kept up with AI bug finding, a failure of SBOMs, Terence Tao on math after AI, the iPhone Duo jailbreak and the eMudhra certificate authority key leak. Cast: Juan Andres Guerrero-Saade and Ryan Naraine. Costin Raiu is traveling. Timestamps: 0:00 Introductory banter 1:07 Black October's pile of critical bugs 2:34 PHP2Shell and the AI victory lap 8:28 Twenty years of PHP technical debt 16:54 Wiz, Gemini 4 Argon and the credit fight 21:01 Chainguard breaks the embargo 28:42 The doomers' warnings and the patching gap 39:32 Is this an SBOM problem? 55:33 Inside the PHP Foundation's post-mortem 1:03:13 Are bugs sparse or dense? 1:11:24 Should frontier labs fix coding? 1:20:14 Vibe coding and math's industrial era 1:27:26 Who pays to maintain open source? 1:44:59 iPhone Duo hacked already, eMudhra and the news