The PHP bug threatening the web. Plus, who's auditing AI?

Security Intelligence panelists Nick, Don and Jim unpack three stories: two decades-old PHP flaws (PHP2Shell) that let attackers take over servers without logging in and were found by AI before patches landed, Anthropic's decision to give outside evaluators employee-like access and whether rival frontier labs should audit each other, and 333 Tor exit relays hijacked through a reused password. The discussion centers on visibility, patching under legacy constraints, secure by design, and the limits of trust in AI and anonymity networks.