AI Summary
5 min read"We Have a Hundred Hackers in Our System Right Now"
In October 2024, a wave of security incidents prompted cybersecurity researchers to call it "Black October." The most prominent was a critical vulnerability discovered in PHP, the coding language used by roughly 70% of websites. What made this discovery different was that AI was used to find and exploit it — and the implications stretch far beyond a single bug. On an episode of Odd Lots, hosts Tracy Alloway and Joe Weisenthal spoke with Tai Yun and Bruce Deng of the hacking firm Caliph, who helped uncover the PHP vulnerability. Both have storied careers: Yun helped reverse-engineer the Stuxnet virus at Microsoft and later worked on iOS security at Apple; Deng spent 12 years at Google hacking products before they shipped. Their conversation offers a grounded, sobering look at how AI is reshaping cybersecurity — and why the old rules no longer apply.
The PHP2Shell Vulnerability: An Old Bug, an AI Exploit
The PHP vulnerability, dubbed "PHP2Shell," was not a new flaw. The PHP Foundation had actually filed the same bug two years earlier, in 2024, but chose not to fix it. The reason was practical: the fix would have required changing core PHP functionality, potentially introducing new bugs or breaking websites. Without a working exploit, the foundation deemed it a low priority.
Continue reading the full summary in the app — free to try.
Read Full Summary →Free • No credit card required
Never miss an episode of Odd Lots
Get every new episode summarized in your inbox — free, ~5 minutes to read.
No spam. Unsubscribe anytime.
What you'll learn
- 1 (02:02) **Black October & The PHP Vulnerability Landscape** - The hosts introduce the episode’s core topic: a wave of “Black October” security issues, led by critical vulnerabilities found in PHP (used by 70% of websites), and the central question of whether AI makes the internet safer or more dangerous.
- 2 (04:41) **Meet the Hackers: Caliph’s Credentials** - Tai Yun (CEO) and Bruce Deng (Engineer) introduce themselves and their most impressive past hacks, establishing their expertise.
- 3 (10:59) **Is AI a Continuation or a Novel Risk?** - The guests argue that AI is both a continuation of known security problems and a dramatic accelerator, making the threat landscape fundamentally new.
- 4 (16:22) **The Discovery of the PHP Vulnerability** - The guests walk through the process of finding the PHP vulnerability, including the surprising backstory of a known-but-unfixed bug.
- 5 (22:50) **Can Defense Stay Ahead of Offense?** - A philosophical discussion on whether defensive cybersecurity can ever outpace offensive capabilities, especially with AI.
- 6 (26:01) **The Awkward Phase of Technical Debt** - The hosts propose that we are in a transitional period where AI is exploiting massive, existing technical debt, but the system could be rebuilt to be more secure.
- 7 (29:31) **Can Software Ever Be Provably Secure?** - The guests explain the concept of formal verification and why it’s not a practical solution for large-scale systems like a browser.
+ Full timestamped outline available in the app
Show Notes
Earlier this year, cybersecurity researchers discovered a vulnerability in PHP, an open-source coding language used in roughly 70% of the world's websites, that had been lying dormant for a long time, and if exploited, could have led to disaster. And the researchers only understood the extent of this bug through the use of frontier AI models. Today, we talk to two staffers at Calif (CEO Thai Duong and engineer Bruce Dang), the cybersecurity firm that was among the first to discover the PHP vulnerability. Their firm partners with the major AI labs and neoclouds, and they help these companies test models and look for vulnerabilities in their infrastructure. Duong and Dang tell us how Calif uncovered the PHP hack, what the firm exactly sells, and what the future of cybersecurity looks like in the age of AI.
Read more:
How AI Is Making Cyberattacks a Bigger Threat
Japan’s Cyberattack Surge Tests Its Push to Strengthen Defenses
Only http://Bloomberg.com subscribers can get the Odd Lots newsletter in their inbox each week, plus unlimited access to the site and app. Subscribe at bloomberg.com/subscriptions/oddlots