Researcher pushes back on 'worst day in cybersecurity history' claims about php2shell
joshua_saxe · x · 2026-10-23
AI safety researcher Joshua Saxe argues that calling php2shell 'the worst day in cybersecurity history' needs justification against historical baselines: celebrity vulns and exploit PoCs, serious TCP/IP/DNS protocol bugs, worm outbreaks, nation-state attacks on critical infrastructure, kernel packet-parsing bugs, and the post-2022 spread of AI social-engineering and hacking tools. Without a clear technical mechanism explaining why this is worse, he says, the argument isn't serious — and such alarmism distracts from the real, looming AI-driven security crisis that needs proper risk models.
Related event: Researcher pushes back on php2shell panic as AI agents clean up(2 posts)→
More from Safety
- Cognition open-sources Devin agent plugin to patch the day's CVE wave — Scobleizer · 2026-10-23
- One prompt found pre-auth PHP RCEs: agent-guided vuln hunting timeline — chrisrohlf · 2026-10-23
- It's not AI slop code causing cyber crises — it's old human slop — emax · 2026-10-23
- METR's OpenAI embed: ~10% of internal Codex traffic unmonitored, agents could sabotage oversight — peterwildeford · 2026-10-23
- Scaling laws will push cyber-grade capabilities into cheap models, ending security bugs — inductionheads · 2026-10-23
- Claude Code's bundled Bun 1.4.3 ships RCE flaw; update past 2.1.308 — KyeGomezB · 2026-10-23