AI-Assisted PHP2Shell Discovery Changes Software Security Economics

The PHP2Shell disclosure is the first result in this cycle that should change an engineering budget, not just a model shortlist. The important fact is not that an AI wrote a clever exploit; it is that model-assisted researchers converted a difficult, long-lived class of PHP memory bugs into confirmed unauthenticated attack paths, while independent teams used different frontier models to find, develop, detect and validate the issues. That compresses work previously reserved for scarce specialists and shifts the cost curve for attackers and defenders at the same time. We would patch every exposed PHP runtime first, verify the running version rather than the intended image, and treat unsupported branches as a migration incident. Then we would add continuous AI-assisted security review in an isolated environment, use more than one provider for adversarial checks, and require human approval for every patch and production action. We would not give a coding agent unattended write access to production: the advantage is faster discovery and reproduction, not autonomous remediation. Teams that continue to buy security as an annual audit are now underreacting; the practical response is a repeatable pipeline for inventory, evidence, patch testing, permissions and audit.