AI finds 948 Linux bugs, and 40 years of old code comes due
Follow-up to Friday Oct 30: PHP2Shell: a chained exploit takes over 25 servers, some US governmentRemember PHP2Shell, the serious PHP flaw that AI helped find and attackers used fast? It is back at the top of Hacker News, in a bigger form. An IEEE Spectrum piece on PHP2Shell, titled 'AI is forcing us to pay off 40 years of technical debt', got 1,184 points and 695 comments. Technical debt is old, messy code we never fixed because waiting was cheaper.
The same day, OpenAI published 'A thousand fewer paths to root'. It built an autonomous pipeline that found, checked and wrote patches for 948 local privilege-escalation bugs in the Linux kernel. These bugs let a normal user become 'root', the all-powerful administrator. OpenAI also made Daybreak Red, with its GPT-5.6 Cyber model, available to approved customers in AWS GovCloud for authorized security work.
On GitHub, a project called sapper-v2 calls itself an 'autonomous pentest legion': an AI commander with a swarm of worker agents. A pentest is an authorized attack to find weak spots. Its authors say it won a Tencent attack-defense competition, running 8 hours unattended.
948 holes found and patched is real, useful work. But it shows the speed problem: if AI finds bugs this fast, attackers with similar tools can too, and humans still have to install the fixes. Ask your IT team how fast you patch today, because 'next month' is now too slow.
