The PHP bug threatening the web. Plus, who's auditing AI?
Security Intelligence panelists Nick, Don and Jim unpack three stories: two decades-old PHP flaws (PHP2Shell) that let attackers take over servers without logging in and were found by AI before patches landed, Anthropic's decision to give outside evaluators employee-like access and whether rival frontier labs should audit each other, and 333 Tor exit relays hijacked through a reused password. The discussion centers on visibility, patching under legacy constraints, secure by design, and the limits of trust in AI and anonymity networks.
PHP vulnerabilities put a large part of the web at risk
Two long-standing flaws in PHP, dubbed PHP2Shell, could let attackers take over vulnerable servers without logging in. PHP runs behind a large share of the web, reportedly 70% or more, so one weakness carries enormous reach. The timing made the disclosure especially troubling. The bugs were found with an AI model, and exploit details started leaking before patches were available, which the panel described as a recipe for disaster. The exploit chain is difficult to use, but the episode shows how fragile the ecosystem becomes when one widely embedded component fails.
The operational problem starts with visibility. As Nick put it, ‘You don’t know you have a problem if you don’t even know where it’s at.’ PHP is embedded in so many products that many teams don’t realize they run it. Versions 8.1 and earlier are affected and will not receive patches, which leaves legacy systems exposed. Upgrading to a supported version is often blocked because it breaks older applications stacked behind it. The fix therefore becomes a strategic exercise rather than a routine patch cycle. Teams need a complete inventory, an agile patch management program, and a willingness to accept downtime.
Jim pushed the discussion past incident response toward secure by design. In his view, the more pressing question is how vendors, open source projects and commercial manufacturers can use the same frontier-model tools that researchers and attackers now use to test their own software before release. Those tools can find flaws, build exploits and help remediate them, so the capability to shift discovery earlier in the lifecycle already exists. He expects bigger black swan events within the next 18 to 24 months, which makes this a planning problem rather than a one-time emergency.
The PHP Foundation’s discovery followed its first external security audit in several years, a gap Nick found both fascinating and concerning. External audits challenge assumptions. Teams believe their mitigations work until someone outside tests them, and human nature pushes people to check the box and move on. An unbiased outside view pays dividends. Nick compared it to having someone else proofread your writing, since authors tend to see what they intended to write.
Anthropic brings outside evaluators onto its campus
Anthropic has invited six researchers from METR (Model Evaluation and Threat Research) to work on its campus, with office space, company hardware and what the company calls ’employee-like access’ to internal tools and systems that are roughly on par with its own risk assessment teams. Nick was skeptical of the framing, calling it ‘mental gymnastics.’ In his view the company simply hired contractors, and the language obscures that. He has no objection to the arrangement itself, only to the description.
Access is tiered, and publication rights track the tiers. Evaluators on the first tier run narrow-scope investigations and can publish only with Anthropic’s approval. The second tier can publish without approval, but Anthropic can restrict what appears, and these evaluators can write rebuttals arguing that redactions are unnecessary. METR’s arrangement sits at the top of this structure, which is what makes its level of access notable.
Jim proposed a model borrowed from the Big Four accounting firms, which rotate peer reviews so each firm examines the others’ audit work and catches what the primary auditor missed. He argued that frontier labs could do the same, with rival labs examining one another’s models, disclosing vulnerabilities responsibly internally, and then sharing results publicly. The key advantage is that the examiner is a competitor rather than a contracted third party, which would give the public more confidence that labs are doing their best to build secure models.
Nick agreed the analogy fits but thought the announcement looked like ‘an overblown, complicated publicity stunt.’ He pointed out that the audit industry has refined this kind of cross-checking for roughly a century and that AI labs could borrow from that work rather than reinvent it. Don agreed that this was probably a publicity stunt but saw potential in the program. If the outside researchers produced real vulnerability findings, the initiative would move from marketing to proof of concept, and that outcome would be the real measure of its value.
Tor exit relays hijacked to harvest credentials
Over several days in October, 333 Tor exit relays were hijacked. Traffic was rerouted and emails were intercepted by an unknown actor. According to Ars Technica and Tor volunteers, the attacker reused valid passwords to access a Tor management server, then installed a Linux backdoor and a credential stealer. The attack was not a sophisticated break. It exploited a basic lapse in password hygiene.
The panel also reflected on what Tor means to security professionals. Many people still associate it with strong anonymity, and Nick said that anyone using Tor should assume the network is hostile. Don agreed that most traffic on the network is not benign, since hosting on the public internet is far easier than hosting on Tor. He noted, however, that Tor has legitimate uses, such as helping people circumvent censorship. Jim added that research and investigations into bad actors sometimes require anonymity, so the tools remain necessary even when the network is risky.
Nick’s conclusion was that this incident was ‘just a flub.’ Over the past year, many threat actor websites have been compromised through their own poor security practices, whether by law enforcement or by rival attackers. As he put it, being a threat actor doesn’t make you immune to bad security practices.