ai-arms-race — tisram

The Wall Street Journal · 2026-10-23 2026-10-23-w3

AI Just Found a Bug That Puts up to 70% of the World's Websites at Risk

PHP2Shell puts a clock on the week's argument. Ryan Austin used GPT-5.6 Sol to take control of in-memory code in as few as a few dozen requests, in a bug class flagged decades ago and dismissed as too hard to exploit. The roughly ten-week embargo, from the Aug 11 call to the Oct 21 patch, broke on one Hacker News post, and a patch of close to 200 files now works as a blueprint. Finding was cheap for the researcher and the attacker alike; absorbing the fix across the long tail of unpatched servers is the slow part. For internet-facing open source, time-to-deploy is measured in hours, so mitigations have to ship before the diff does.

# tags

ai-arms-race ai-cybersecurity cybersecurity open-source openai patch-velocity responsible-disclosure supply-chain-security vulnerability-management wsj

The Wall Street Journal 2026-10-23-1

AI Just Found a Bug That Puts up to 70% of the World's Websites at Risk

PHP2Shell had a patch ready and the exposure still sits with the long tail of unpatched PHP servers. Ryan Austin used GPT-5.6 Sol to take control of in-memory code in as few as a few dozen requests, in a bug class flagged decades ago and dismissed as too hard to exploit. The roughly ten-week embargo, from the Aug 11 call to the Oct 21 patch, broke on one Hacker News post. A patch of close to 200 files now doubles as a blueprint, so time-to-deploy is measured in hours.

# tags

ai-cybersecurity cybersecurity patch-velocity open-source vulnerability-management responsible-disclosure openai supply-chain-security wsj ai-arms-race

◆ entities

Systemic risk AI safety Open Source Strategy Agent governance Verification Infrastructure

→ threads

ai-cybersecurity supply-chain-security

⟷ links

2026-05-22-3 2026-03-09-3 2026-04-01-3 2026-04-05-1 2026-03-11-2 2026-04-22-2 2026-05-02-3 2026-05-01-w3 2026-05-01-w1 2026-05-22-w2

permalink

New York Times 2026-05-14-1

Google Says Criminal Hackers Used A.I. to Find a Major Software Flaw

Google's criminal AI zero-day confirms the new attack topology: AI compressed bug discovery to near-zero cost, but the attacker still needed credentials and the patch cycle still ran in days. The asymmetric trade sits in IAM hardening and patch-velocity infrastructure. The AI-security pure-plays are already priced for the headline; the credential layer is what actually moved.

# tags

ai-cybersecurity mythos vulnerability-management ai-policy ai-1.0-defensibility dual-use-research ai-security anthropic google responsible-disclosure restricted-access ai-regulation nyt agent-supply-chain ai-arms-race ai-policy-capture patch-velocity oss-security-funding

The New York Times 2026-05-12-2

Google Says Criminal Hackers Used A.I. to Find a Major Software Flaw

AI compressed vulnerability discovery to near-zero cost; credentialed access remained the second gate. Google's disclosure of the first criminal AI-enabled zero-day is the empirical confirmation that the offense-side binding constraint has shifted from bug-finding to credential acquisition, which re-rates the IAM stack more cleanly than the AI-security pure-plays. Rob Joyce's "fingerprint at the crime scene" line points to a parallel category in forensic AI-authorship detection that remains structurally unfilled.

# tags

ai-cybersecurity ai-security mythos anthropic google vulnerability-management responsible-disclosure ai-policy restricted-access ai-1.0-defensibility ai-regulation nyt dual-use-research agent-supply-chain ai-arms-race ai-policy-capture