AI Is Forcing Us to Pay Off 40 Years of Technical Debt

TL;DR

The PHP2Shell vulnerability, disclosed in late October, put major websites at risk—including NASA, Wikipedia, and the White House—by allowing arbitrary code execution on servers running PHP. Discovered by AI-assisted researchers, it underscores a growing crisis: AI is making it easier to find and exploit flaws in legacy software, forcing the industry to confront decades of accumulated technical debt. While the immediate threat was patched, experts warn this is just the beginning, with AI-powered attacks likely to escalate unless defenders adopt new tools and strategies.

The PHP2Shell Wake-Up Call

In late October, cybersecurity researchers uncovered a critical vulnerability in PHP, a programming language created in 1994 that still powers a huge portion of the web. Dubbed PHP2Shell, the flaw could allow attackers to read sensitive data and run malicious code on servers running WordPress, Drupal, and other popular platforms. The list of affected sites included NASA, Wikipedia, and the White House—an alarming reminder of how deeply the internet relies on aging infrastructure.

Fortunately, the vulnerability was found by white-hat researchers who reported it to the PHP Foundation before any known exploitation. A patch was released after a two-month effort by a team of four engineers. But the incident has sent shockwaves through the cybersecurity community, serving as a stark warning about the challenges ahead.

AI Lowers the Barrier to Exploitation

What made PHP2Shell particularly concerning is how it was discovered. The bug itself was a common out-of-memory error, typically dismissed as a crash-level nuisance. However, researchers at cybersecurity firm Calif, sponsored by OpenAI, used AI tools to turn that minor flaw into a full remote code execution exploit within two weeks. This demonstrates a fundamental shift: AI can now handle the painstaking, detailed reasoning required to chain memory corruption into a full-fledged attack.

“It’s not really rocket science,” says Suman Jana, an associate professor of computer science at Columbia University. “It’s just that it’s a lot of very specific reasoning that is painful to do. And AI, I think, has done a very good job at that.” This capability is not limited to elite hackers. As AI tools improve, even those without deep expertise can leverage them to find and exploit vulnerabilities, dramatically expanding the threat landscape.

This is not hypothetical. Security firm Norforge reported an incident where a hacker gave AI agents fewer than 100 Chinese characters of instructions. The agents then attempted to breach over 1,200 sites and succeeded in more than 100. The barriers to entry for cybercrime are collapsing, and the targets are the vast, aging systems that make up the internet's backbone.

Decades of Technical Debt Come Due

The root of the problem is what experts call “technical debt”—the accumulation of outdated, poorly maintained, or insecure code written over the past 40 years. “One of the things we’re witnessing now is that all the legacy software that was written by humans over the last 40 years is being exposed,” says Matt Suiche, AI security research lead at cybersecurity startup Tolmo. “Now it is time for the technical debt to be paid off.”

Much of this software is open-source, maintained by volunteers or small teams with limited resources. Projects like PHP lack clear revenue streams, yet they underpin a massive portion of the web. The result is a ticking time bomb: critical systems running on code that is increasingly vulnerable to AI-powered attacks.

The scale of the problem is staggering. From hospital equipment to bank mainframes, outdated technology is everywhere. And as AI continues to evolve, the ability to sweep across the entire stack of technical-debt-laden technology becomes easier and more dangerous.

The Asymmetry of Defense

One of the most troubling aspects of this new landscape is the asymmetry between offense and defense. Finding a vulnerability is often easier than fixing it. “There is a fundamental asymmetry in finding bugs and fixing bugs,” explains Jana. “When you’re fixing bugs you have to make sure that you know all parts of that attack are closed, and also that you don’t break any existing functionality.”

This puts enormous strain on defenders, particularly for open-source projects that lack dedicated security teams. While AI is accelerating the discovery of vulnerabilities, it is not yet equally effective at patching them. However, there is hope: formal verification tools, which use AI to generate and verify patches, are advancing rapidly. Anthropic released a new tool in late October that can generate a patch and then prove its correctness, with only the final proof check done by a human. This could help automate the patching process and level the playing field.

The Economic Dimension: AI's Debt Problem

The technical debt crisis is compounded by a financial one. The AI boom is driving massive spending by a handful of tech giants, who are taking on enormous debt to fund their AI infrastructure. Venture capitalist Chamath Palihapitiya warns that AI companies’ debt has reached an estimated $340 billion to $400 billion, threatening to “crowd out” U.S. Treasury demand. “The entire United States economy is levered to the AI complex,” he said on the All In podcast.

This spending binge is already straining balance sheets. S&P Global Ratings cut its outlook on Meta to negative, and Alphabet reported negative free cash flow. OpenAI reportedly cut its latest fundraising target by $10 billion amid a tech selloff. The concentration of debt in a narrow set of GPU-focused companies creates systemic risk, as Blackstone President Jon Gray points out. When debt investors pile into the same handful of companies, portfolio diversification disappears, and events like CoreWeave's debt crisis can trigger industry-wide contagion.

This financial fragility matters for cybersecurity because the same companies that dominate AI are also the ones funding security research and developing defensive tools. If they are distracted by financial pressures, the entire ecosystem suffers.

What Comes Next

Experts are divided on how quickly the industry will respond. Matthew Green, an associate professor at Johns Hopkins, is pessimistic: “Nobody’s going to fix this problem until something really bad happens. And PHP2Shell wasn’t bad enough to be really bad. So when something really bad happens, which is going to be maybe sometime in early 2027, something bad that normal people are upset by, then suddenly people will start doing this. We’re going to fund everything.”

In the meantime, the advice is simple: update your software. “If your phone is like, ‘Hey, there’s a security update available, do you want to install it,’ don’t wait til next week. Just do it,” says Green.

But individual vigilance is not enough. The industry needs a coordinated effort to address technical debt, from funding open-source maintenance to deploying AI-powered defensive tools. “These frontier labs are donating some of their token budgets to look into these bugs, which I think is great,” says Jana. “I think that should happen more, either through some concerted effort or through donations.”

One thing is certain: PHP2Shell is just the beginning. “This won’t be the last one for sure,” Jana says. “It’s just who finds it. Hopefully, the white hat hackers find it first, like this one.”

Why It Matters

The intersection of AI and technical debt is not just a cybersecurity issue—it’s an economic and societal one. As AI lowers the barrier to cybercrime, the cost of inaction grows. The systems we rely on daily—from government websites to healthcare infrastructure—are built on decades-old code that is becoming increasingly fragile. Paying off this technical debt is no longer optional; it’s a matter of national security and economic stability.

The good news is that AI can be a double-edged sword. The same tools that expose vulnerabilities can also help fix them, if we invest in the right ways. But time is running out. The next PHP2Shell might not be so lucky.