topic Re: PHP2Shell Is a Wakeup Call for AI in Cybersecurity - IEEE Spectrum in Discussions

PHP2Shell Is a Wakeup Call for AI in Cybersecurity - IEEE Spectrum

Anonymous — Mon, 02 Nov 2026 20:34:51 GMT

PHP2Shell Is a Wakeup Call for AI in Cybersecurity - IEEE Spectrum
The PHP2Shell Vulnerability Heralds Cybersecurity Hell
AI is forcing us to pay off 40 years of technical debt

The best defense is to switch from regular Firefox to Firefox ESR (Extended Support Release), which is more stable (and also retains the classic Proton UI). See Navas' Tips: Firefox UI Debacle

Re: PHP2Shell Is a Wakeup Call for AI in Cybersecurity - IEEE Spectrum

dftf — Mon, 02 Nov 2026 17:30:51 GMT

Really not sure what point you're trying to prove on this subject?

Essentially you see PHP as the weak-point, as per the infamous XKCD meme:

Okay, it's bad, sure. But so were the Spectre and Meltdown CPU flaws: the former affecting AMD, Arm and Intel; the latter I believe just Intel (could be wrong). Last I checked, AMD and Intel directly make their own chips (they don't licence the designs, unlike Arm), and their firmware is closed-source. So major panic at the time, caused by private companies with entirely closed-source code.

And sticking just to software, it's easy to find examples for Microsoft:
• Windows Media Audio and Video formats: various historical security-issues have been patched;
• the Journal app (from XP Tablet to Win10 1511) got removed due to remote-code execution risks;
• the Desktop Gadgets in from Vista and 7 ended in 8, due to remote-code execution risks;
• Remote Desktop has had various security issues fixed with both the app, and the protocol it uses;
• Internet Explorer (security not the only reason, but: ActiveX, weaker sandboxing, patching via WU);
• HomeGroup (can't-recall the exact details, but again there was some security-flaw with it)
• Microsoft Office: various security issues fixed over the years, including with the file-formats themselves, and defaults, such as restricting the use of ActiveX, Marcos and External Data Links, hardened over-time

So, sure, could there be a major exploit in an ffmpeg codec, and a malformed AAC, MP3, FLAC, H.264 or AV1 video hack someone's device? Maybe. Could a maliciously-crafted 7-Zip or RAR hack Windows 11 or a Linux system via libarchive? It's possible, yup. Could a bad actor find a way to hack a device via a corrupt LibreOffice file-format, or perhaps the converter they use to open Microsoft's formats? Could happen.

But I don't see your obsession with "open source, small team or project = inherently bad". Pretty-much all major software thesedays, including that on modern games-consoles and smart TVs, and firmware (such as in other smart gadgets, or routers and network switches) get regular updates. How is open-source any different? I mean, I called Windows out above as it just the one I found examples easiest to think of, but you could easily repeat that for other major, closed-sourced OSes (macOS, iOS, Android) or major closed-source apps (Adobe's software, for example).

I get your argument "in the age of AI finding vulnerabilities in code, smaller-teams may not be able to react quickly-enough". But those people can also use those same AI models to vet their own code too, helping to create a patch quicker. It works both-ways.

Re: PHP2Shell Is a Wakeup Call for AI in Cybersecurity - IEEE Spectrum

Anonymous — Mon, 02 Nov 2026 20:37:19 GMT

As I've stated previously:

The PHP crisis is a reality check on browser forks. Firefox is 20+ million lines of complex C++ and Rust code that processes hostile web content every second. If an industry-critical foundation cannot afford adequate engineering bandwidth, expecting volunteer-run forks to safely audit, rebase, and secure massive browser codebases is unrealistic. Public code on GitHub does not replace dedicated enterprise maintenance infrastructure.

But not just volunteer browser forks—upstream Firefox is also vulnerable due to (a) loss of talent and institutional knowledge over the past several years and (b) now trying to do too much with less, which increases the risk to volunteer forks.

PHP Foundation 'Under-Funded' With One Full-Time Staff Member, Director Says | Reuters
- Funding comes from donations and grants
- AI-related increase in coding has doubled foundation's workload

To lurkers who have missed my detailed explanations:

Re: PHP2Shell Is a Wakeup Call for AI in Cybersecurity - IEEE Spectrum

dftf — Mon, 02 Nov 2026 18:40:02 GMT

Okay, so you're now saying Firefox is unsafe to use too, given the speed with which AI coding models can now find issues in code? (Even though as I said, surely coders within Firefox could run AI agents on the codebase themselves to find issues and suggest the patches, as is now happening regularly for the Linux kernel, with Torvalds himself in-favour-of AI-assisted patch submissions, providing the human who submits them has personally tested it.)

Yet in a previous conversation, I pointed-out how Google Chrome is usually first to push-out a security-fix, then Brave usually follows within 1-2 days after, but Microsoft Edge can sometimes take up to a week. To which you said (paraphrasing) that you don't mind a delay as they have to test the patch to ensure it won't break workloads.

So... getting difficult to know what you want here.

Open-source, small teams = bad, as they cannot patch quickly-enough in this AI age.

Closed-source, large company = good if they delay patches to ensure it doesn't break stuff.

I get the feeling maybe you'd be happier not using any software at this point...? 🤷🏻‍♂️

Re: PHP2Shell Is a Wakeup Call for AI in Cybersecurity - IEEE Spectrum

Anonymous — Mon, 02 Nov 2026 20:39:43 GMT

@dftf wrote:
Okay, so you're now saying Firefox is unsafe to use too, given the speed with which AI coding models can now find issues in code?
…
I get the feeling maybe you'd be happier not using any software at this point...? 🤷🏻‍

I've not said that.
Please stop the offensive straw man arguments and personal comments.
What I wrote speaks for itself.

To lurkers who have missed my detailed explanations:

Re: PHP2Shell Is a Wakeup Call for AI in Cybersecurity - IEEE Spectrum

dftf — Mon, 02 Nov 2026 19:57:15 GMT

> upstream Firefox is also vulnerable due to (a) loss of talent and institutional knowledge over the past several years and (b) now trying to do too much with less, which increases the risk to volunteer forks

Surely (a) is applicable to most companies, as older people leave and take knowledge with them; hence why you often get rewrites of apps, to move-away from legacy code fewer people understand (e.g. classic Outlook getting replaced by "Outlook (new)", the version that comes from the Microsoft Store), or apps get retired (e.g. Microsoft Publisher) as no-one can work on them, or there simply aren't the resources to allocate to them. Could Firefox face the same issue? Sure, I guess, but I've no evidence to say it's the case now.

And for (b), I don't have insider-knowledge to know how many staff Mozilla has, and what part of the product they are allocated to, but features in Firefox have always come-and-gone: FTP support, RSS feeds, NPAPI plug-ins, Pocket, official 32-bit Linux support are all things now gone. If you have insider knowledge they are stretched-thinly then fine, but that's not something I can prove, so until there is a mainstream news article reporting on massive layoffs at Mozilla or something then... keep using it for now? 🤷🏻‍♂️

I mean, honestly, given I first encountered you on this website as you were one of many voicing their displeasure at the new "Nova" UI, it does seem we're now on quite a tangent from that; we've gone from "use the ESR instead" to now (again, paraphrasing: not the same as a straw-man) you seem to be implying that in the age of AI finding bugs in code that due to the two factors you mentioned, Firefox may not be safe period? Or at-least it might not be safe in the future were the two conditions you outlined to be true, or come to be true.

To which I'd say: do you have evidence right-now that Mozilla is spread too-thinly for staff? If not, then isn't that just speculation, and something which could apply to many large companies? I mean, didn't Microsoft literally announce last-week it's seeking to reduce headcount by 60,000 staff (around 27% of their global employees)? So... should we not use Edge now? What if the team that makes it will see many staff lost?

As fun as discussions in themselves can be, I do tend to prefer ones that reach some sort of conclusion. So... which browser should we actually use?

Re: PHP2Shell Is a Wakeup Call for AI in Cybersecurity - IEEE Spectrum

Anonymous — Mon, 02 Nov 2026 21:12:41 GMT

Please keep up:

2020: Mozilla Is Laying off 250 People and Planning a ‘New Focus’ on Making Money | the Verge
Mozilla is laying off 250 people, about a quarter of its workforce, and plans to refocus some teams on projects designed to make money.
2024: Firefox Maker Mozilla Is Cutting 60 Jobs After Naming New CEO
Mozilla said that the move affects about 5% of its workforce and that the cuts were primarily in the product development organization. The company informed employees of the decision on Tuesday.

To lurkers who have missed my detailed explanations:
The best defense is to switch from regular Firefox to Firefox ESR (Extended Support Release), which is more stable (and also retains the classic Proton UI). See Navas' Tips: Firefox UI Debacle

Re: PHP2Shell Is a Wakeup Call for AI in Cybersecurity - IEEE Spectrum

dftf — Mon, 02 Nov 2026 21:30:02 GMT

Okay, and I literally just gave you the example (which is established fact, not my own opinion as reputable outlets have reported it) that Microsoft are seeking to remove 60,000 people from their workforce, representing around 27% of current global staff.

So... by your own logic, does that now make Edge unsafe to consider using?

Re: PHP2Shell Is a Wakeup Call for AI in Cybersecurity - IEEE Spectrum

Anonymous — Mon, 02 Nov 2026 21:41:13 GMT

There is simply no comparison between Mozilla and Microsoft.

Re: PHP2Shell Is a Wakeup Call for AI in Cybersecurity - IEEE Spectrum

dftf — Mon, 02 Nov 2026 22:12:24 GMT

Okay, perhaps you could just not use Firefox?

It sounds like you'd be happier with Edge (though isn't Edge is in-effect a "fork" of Google Chrome, where Microsoft take-out Google's services and replace them with their own, so maybe just move to Google Chrome? Can't get more-direct then, and security patches will arrive fastest.)

Either-way, move to whichever browser you personally feel is safest and has the best-chance of surviving in the new age of AI finding vulnerabilities we now live in. I'm personally happy to keep using Firefox until a large online tech-focused news site warns otherwise.

Re: PHP2Shell Is a Wakeup Call for AI in Cybersecurity - IEEE Spectrum

Anonymous — Mon, 02 Nov 2026 22:16:02 GMT

I've already explained why I currently choose to use Firefox ESR (not Firefox standard).

Re: PHP2Shell Is a Wakeup Call for AI in Cybersecurity - IEEE Spectrum

Agentvirtuel — Tue, 03 Nov 2026 05:01:59 GMT

Bonjour

About the subject See Navas' Tips: Firefox UI Debacle.

To complement,

A space for users to give product feedback
https://support.mozilla.org/en-US/kb/what-mozilla-connect

I don't like you last updates with interface change with curvy bottons and color thems. let me get back
https://support.mozilla.org/en-US/questions/1615448

Re: PHP2Shell Is a Wakeup Call for AI in Cybersecurity - IEEE Spectrum

Agentvirtuel — Tue, 03 Nov 2026 05:30:16 GMT

Pourquoi de nombreux sites ont soudainement été mis « en maintenance »
https://forums.mozfr.org/viewtopic.php?t=159303