OM DENNE EPISODE
(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)
Three Buddy Problem - Episode 117: This week, we dig into PHP2Shell, the AI-assisted PHP bug that led governments to take websites offline, and the arguments over broken embargoes, who found it first, and the AI doomers taking an "I-told-you-so" victory lap.
Plus, why patching hasn't kept up with AI bug finding, a failure of SBOMs, Terence Tao on math after AI, the iPhone Duo jailbreak and the eMudhra certificate authority key leak.
Cast: Juan Andres Guerrero-Saade and Ryan Naraine. Costin Raiu is traveling.
Timestamps:
0:00 Introductory banter
1:07 Black October's pile of critical bugs
2:34 PHP2Shell and the AI victory lap
8:28 Twenty years of PHP technical debt
16:54 Wiz, Gemini 4 Argon and the credit fight
21:01 Chainguard breaks the embargo
28:42 The doomers' warnings and the patching gap
39:32 Is this an SBOM problem?
55:33 Inside the PHP Foundation's post-mortem
1:03:13 Are bugs sparse or dense?
1:11:24 Should frontier labs fix coding?
1:20:14 Vibe coding and math's industrial era
1:27:26 Who pays to maintain open source?
1:44:59 iPhone Duo hacked already, eMudhra and the news
Links:
- Transcript
- PHP Foundation: How We're Strengthening PHP Security
- RCE via OOM corruption · Advisory
- RCE via stale global state · Advisory
- PHP2Shell by Calif Research
- Wiz: PHP2Shell: AI uncovers critical RCE vulnerabilities in PHP
- Chainguard CEO explains breaking PHP vuln embargo
- Alpha-Omega – Open Source Security Foundation
- OpenAI Daybreak: Patch the Planet
- VirusTotal: Sizing the PHP exposure window
- Mathematics in the age of AI
- 3Blue1Brown on YouTube
- There's never been a better time to go into math - YouTube
- Terence Tao Talks to Numberphile About AI
- Disgraced eMudhra drops out of TLS business
- Node.js Patches Brotli Remote Code Execution Flaw
- Max-severity GitLab bug allows remote code execution over 12 years of releases
- Inside the LiteLLM 1.107.0 supply chain compromise
- Calif hacks new hardware based UFP mitigation in the iPhone Duo
- CTI in Agentic Times (Costin/Vicente training)
- TLPBLACK
