Skip to content
Sign in
Artwork for Crying Out Cloud
Crying Out Cloud · Wednesday · 36 min

Breaking Down PHP2Shell with Sagi Tzadik & Thai Duong

🚨 How AI just broke PHP (and 70% of the internet).On this episode of Crying Out Cloud, Amitai Cohen sits down with Sagi Tzadik (Wiz Research) and Thai Duong (Calif) to unpack a massive PHP RCE vulnerability discovered entirely by AI agents.This isn't just another zero-day story. It's a look at the terrifying new reality of "agentic exploit development." What used to take human researchers months of tedious lab setups and debugging to weaponize a memory corruption bug took AI agents a couple of weeks, working while the researchers slept.What's Inside:- How an AI model looking for a Drupal bug accidentally found a foundational PHP flaw from 2004.- Why AI scaling exploit development across multiple software versions changes the threat landscape.- The massive logistical challenge of coordinating a patch for 70% of the web alongside distros, WAFs, and cloud providers.- How defenders can use these same AI agents to scale detection engineering.

0:00-36:02
Play in

transcript

No transcript — this publisher did not publish one.

show notes

🚨 How AI just broke PHP (and 70% of the internet).On this episode of Crying Out Cloud, Amitai Cohen sits down with Sagi Tzadik (Wiz Research) and Thai Duong (Calif) to unpack a massive PHP RCE vulnerability discovered entirely by AI agents.This isn't just another zero-day story. It's a look at the terrifying new reality of "agentic exploit development." What used to take human researchers months of tedious lab setups and debugging to weaponize a memory corruption bug took AI agents a couple of weeks, working while the researchers slept.What's Inside:- How an AI model looking for a Drupal bug accidentally found a foundational PHP flaw from 2004.- Why AI scaling exploit development across multiple software versions changes the threat landscape.- The massive logistical challenge of coordinating a patch for 70% of the web alongside distros, WAFs, and cloud providers.- How defenders can use these same AI agents to scale detection engineering.

more episodes

All episodes