Security researcher: php2shell is no discontinuity, but now is the window to harden everything
joshua_saxe · x · 2026-10-23
Security researcher Joshua Sarge responds to Matthew Green and others in the debate over php2shell (AI-assisted vulnerability exploitation). He notes the disagreement is whether php2shell represents a major discontinuity: he sees it as continuous with a rising tide of AI capabilities that haven't yet translated into real damage, and argues that now is the window in which to harden everything, rather than waiting a few weeks to see what happens.
Related event: Matthew Green Slams Vendors for Missing the AI Defense Hardening Window(21 posts)→
More from Safety
- HarmAmp benchmark shows LLMs amplify harm over multi-turn chats; TrajSafe monitor intervenes early — alan_ritter · 2026-10-24
- Weeks later: still no word on METR and Redwood returning to resume safety investigation — DKokotajlo · 2026-10-24
- Meta's new commercial terms put legal liability for AI mistakes on customers — esporx · 2026-10-24
- Rob Leclerc: AI safety overreactions undermine real concerns, let markets decide — robleclerc · 2026-10-24
- Baseten and Goodfire launch Project Beacon to embed safety in the inference layer — baseten · 2026-10-24
- ~6K-param router-logit detector cuts VLM safety errors by up to 92% — shangbinfeng · 2026-10-24