Oct 30, 2026 · 58 min
AI compresses the path from vulnerability to cyberattack
PHP2Shell Won't Be the Last Big AI Cybersecurity Risk
The episode examines whether defenders can match AI-accelerated attackers before software flaws become exploitable at unprecedented speed and scale.
- 1AI can compress vulnerability research and exploit development that once took months into days.
- 2PHP research showed AI-assisted discovery can expose longstanding flaws while also raising questions about practical exploitation.
- 3Formal verification and existing defenses remain limited as coding agents, sandboxes, and reverse-engineering tools become more capable.
Don't miss
Thai Duong and Bruce Dang describe how AI shortened the path from reverse engineering to sophisticated exploit development.
The brief
Thai Duong and Bruce Dang, cybersecurity researchers from Calif, frame AI as an accelerator that compresses vulnerability research, reverse engineering, and exploit development.
Their PHP investigation, conducted with Wiz and OpenAI, uncovered longstanding vulnerabilities while exposing the harder question: did AI find the bugs, or make exploitation practical?
The defensive response is constrained by software complexity: formal verification works for smaller components, but browsers and constantly changing systems remain difficult to prove secure.
AI coding agents and sandboxes create a structural risk because the tools built to write and test software can also reproduce a hacker’s workflow.
The episode’s bleak conclusion is that faster patching may not be enough; cybersecurity defenses may need fundamental redesign as attackers gain machine assistance.
What was said on this episode
17 statements · 4 positive · 13 negative
- Bruce Dangon AI-assisted cybersecurityNegative14:52
AI accelerates vulnerability identification and exploitation to near-superhuman speed.
“What AI has done is it's kind of accelerated the speed in which you identify and exploit these vulnerabilities to a level where... It's almost like superhuman.”
Listen at 14:52
- Bruce Dangon AI-assisted vulnerability researchPositive15:28
AI can reduce some vulnerability research from months to days with one person.
“Now, that may take you a few days with just one person and a very capable AI model.”
Listen at 15:28
- Thai Duongon AI-assisted exploit developmentNegative24:26
AI plays a major role in developing vulnerability exploits.
“And for exploitation, AI plays a major role in it.”
Listen at 24:26
- Bruce Dangon AI-assisted defensive cybersecurityPositive25:40
AI may help defenders create more secure software and systems over time.
“over time, we're going to perhaps use AI to help us write more secure software or build more secure systems”
Listen at 25:40
- Thai Duongon AI in cybersecurityNegative27:51
AI currently benefits attackers more than cybersecurity defenders.
“Right now, you know, AI helps attackers more than defenders.”
Listen at 27:51
- Thai Duongon AI-assisted vulnerability discoveryNegative29:11
AI-assisted analysis found roughly ten times more bugs than expected in some systems.
“But now there's still a lot of bugs there as well. And a lot mean like... a lot more like 10x more than we expected”
Listen at 29:11
- Bruce Dangon Formal verification of browser-scale softwareNegative32:02
Formal verification does not currently scale to browsers and similarly complex software.
“today doing, you know, like formally verified software, you know, like it doesn't work at that scale. It's typically smaller, smaller software components.”
Listen at 32:02
- Bruce Dangon Formal verificationPositive32:49
Formal verification is one possible path toward building more secure systems.
“this is i think this is like one of the one of the paths forward to make to build more secure systems”
Listen at 32:49
- Thai Duongon AI-driven vulnerability exploitation windowNegative40:02
AI is collapsing the time defenders have to patch vulnerabilities across major software platforms.
“now that window is collapsing It is collapsing everywhere, not just in PHP, right? In Windows, in Mac OS, in anything.”
Listen at 40:02
- Thai Duongon Coding-capable AI agentsNegative44:38
Automating knowledge work requires AI capable of computer control and hacker-like technical reasoning.
“But as long as you want to automate knowledge work, you know, then eventually you must, your AI must be able to use computer and control computer, understand technical problems. And that's the definition of someone like Bruce. So it's unavoidable.”
Listen at 44:38
- Bruce Dangon Open-source AI modelNegative46:03
An open-source AI model reverse-engineered and hacked printer firmware far faster than humans.
“it reverse engineered the firmware on, you know, some Canon or like, you know, HP printer and it hacks it, you know, whereas before it would take me, you know, like months to figure some stuff out.”
Listen at 46:03
- Bruce Dangon AI-assisted iPhone exploit developmentNegative47:10
AI enabled one person to build a complete iPhone exploit chain within days.
“Our team was able to do this within a few days as one person.”
Listen at 47:10
- Thai Duongon AI-driven bank network attacksNegative48:56
AI-driven attackers spread throughout two banking clients’ networks within about one day.
“For the AI, they came in, they broke inside the network on Monday. By Tuesday, they're everywhere. Everywhere. It's like cancer. It's spread like at a machine speed.”
Listen at 48:56
- Thai Duongon Human-AI hacking teamsPositive51:15
The strongest current hackers combine AI with human expertise.
“the best hacker right now is a combination of AI and humans.”
Listen at 51:15
- Thai Duongon AI hacking capabilityNegative51:36
AI may eliminate the need for human hackers within months to a few years.
“Maybe three months. Maybe, you know, we come back here and like by the end of the year, we tell you we retire now. There's nothing else for us to do.”
Listen at 51:36
The human-AI advantage in hacking may disappear relatively soon.
“But that may not be there for much longer. Three months a year. We have no idea. But the presumption should be that it won't last very long.”
Listen at 53:42
A computer agent capable of coding is inherently capable of hacking.
“the idea of like a computer, an agent that can code is inherently a hacker. And so you can't just tell it not to hack.”
Listen at 53:52
Statements are attributed to the speaker as said on the episode and reflect their view at the time, not PodLume's. They are not advice.
Weekly email
State of the Pod, every Monday
The week's most-discussed names and stories from podcasts, with the moments behind them. Free, five minutes, unsubscribe in one click.