> ## Content Index
> Fetch the complete content index at: https://saadiq.xyz/newsletter/llms.txt
> Use this file to discover other available public pages before exploring further.

# My P(doom) After PHP2Shell
- URL: https://saadiq.xyz/newsletter/my-p-doom-after-php2shell/
- Published: 2026-10-27T17:54:56.000Z
- Updated: 2026-10-27T17:54:56.000Z
- Description: PHP2Shell and a week of breaches have everyone rattled. The tools finding the holes also let me patch a pile of neglected servers overnight and fence my web server off from the rest of my network. My P(doom) has less to do with AI than with the people deciding how to use it.
- Author: Saadiq Rodgers-King
- Tags: Security, AI, Tech Industry, Software Development

People keep asking me about P(doom), the probability that AI ends badly for humanity. My answer is that the technology doesn't scare me. People do.

I'm not worried about a superintelligence scorching the sky, plugging us into batteries, or turning the planet into paperclips. I'm worried about careless leaders handing badly built AI, or any AI, full discretion over who lives and dies. I'm worried about people making bad decisions quickly and at scale, and about people who are cavalier with human life getting far more capable tools. This is an inflection point, and it's arriving at a moment when I don't trust a lot of the people holding the controls.

I'm also worried about the algorithms that decide what we see and the media that feeds them. AI is certainly a tool for those algorithms, but the damage is already done without it. We live in bubbles with divergent notions of what's true, and without any shared ground truth we can't talk to each other. I'm supposedly an expert in this space, and I still have a hard time with the AI data center debate. I can't tell which claims, for or against, are willful propaganda, which are inadvertent propaganda, and which are simply true.

Security is where the people problem is easiest to see right now, because last week was a lot.

## A week of holes

- **PHP.** On October 20, details leaked about two critical bugs in PHP, the language behind a huge share of the web, including WordPress. Together they're called PHP2Shell, and they let an attacker run code on a server without logging in. PHP shipped emergency fixes on October 21, and [CISA](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching?ref=saadiq.xyz) added both bugs to its list of exploited vulnerabilities on October 26\. Researchers at Calif and [Wiz](https://www.wiz.io/blog/php2shell-php-rce?ref=saadiq.xyz) found them independently, with help from OpenAI's and Google's frontier models.
- **Node.js.** The same day, Node patched [ten vulnerabilities](https://www.rapid7.com/blog/post/etr-cve-2026-111497-critical-out-of-bounds-write-in-the-node-js-brotli-decoder/?ref=saadiq.xyz), including a remote code execution bug in its Brotli decompression code.
- **eMudhra.** The private keys for eight of this Indian certificate authority's intermediate certificates [turned out to be compromised](https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html?ref=saadiq.xyz), which meant anyone could forge a certificate for any website. Browsers blocked them, and eMudhra says it's leaving the certificate business.
- **Railway.** The cloud hosting platform [disclosed](https://blog.gitguardian.com/railway-october-2026-incident-environment-variables/?ref=saadiq.xyz) that an attacker may have reached customer environment variables, which is where developers keep API keys and database passwords. It paused all deployments.
- **Tailscale.** On October 25, a researcher published [eleven unpatched flaws](https://thehackernews.com/2026/10/unpatched-tailscale-ssh-flaws-could-let.html?ref=saadiq.xyz) in Tailscale, the private network I use to connect my own devices, without giving the company time to fix them first.

Dan Lorenc runs Chainguard, a company that ships hardened software packages. In a [LinkedIn post](https://www.linkedin.com/feed/update/urn:li:activity:7518756994284077056/?ref=saadiq.xyz) after the release, he wrote that one of the original researchers told his team something was coming in PHP. That same night, they "were able to independently discover the same issue using our harness and a frontier model with a basic prompt of 'find bad vulnerabilities in PHP'."

That ease is part of why he shipped fixed builds hours before the agreed release time, a call the PHP maintainers publicly disagreed with. Critics pointed out that a fixed build released early hands attackers a map to the bug while everyone else waits. I don't have the security credentials to make a moral judgment here, but we're clearly in new territory.

## Paying for nothing to happen

One of the bugs behind PHP2Shell, an out-of-memory error, [was found in 2020 and found again in a 2024 audit](https://en.wikipedia.org/wiki/PHP2Shell?ref=saadiq.xyz). It never got fixed because nobody had shown it could be exploited. A frontier model turned it into remote code execution.

That's the challenge with security. We've always underinvested in it because you're paying for nothing to happen. You can't tell when you're overpaying. You only find out you underpaid when something bad happens. Or you underinvest, get lucky, and it looks exactly the same. On an average day the money goes out and nothing happens, and most organizations are bad at valuing that. Nobody's shocked anymore when a credit card company or a hospital leaks everyone's personal data.

Security people call this threat modeling. You calibrate your defenses to two things, what you're protecting and who'd want it. A blog full of public posts is a different problem from a database of customers' personal information, and both are different from a crypto wallet that can be drained in one transaction and never recovered. Then there's who's coming. Some mischievous kids looking for fun? A hacker group trying to sell data or blackmail you? A company intent on corporate espionage? A nation state doing what I can't even imagine? For most of us, the answer has been to spend in proportion and stay a little more secure than the people to our left and right. A determined attacker with resources was always hard to stop, but most of us weren't worth one.

What's new is a program that reasons through a codebase and doesn't get tired. It'll check every inch of the surface, combine small weaknesses, and keep experimenting long past the point where a person would go home. Now the mischievous kids can attack like a corporation, or like a nation state from a few years ago. And when one attacker can probe everyone at once, being a little safer than your neighbors stops protecting you. It's almost comic that we're shocked these tools are finding holes.

I'd discount the breathless versions of this a little. Frontier labs benefit from the story that their models can break into anything, because the next sentence is that you should buy their models to defend yourself, or buy their stock when they go public. Some of that is substance, and some of it is self-serving.

## Boring targets lost their cover

Over the last two days I ran Cloudflare's security audit skill against a client's codebase. It found a pile of issues that are technically vulnerabilities and practically unlikely. Whoever might want to attack this particular client isn't going to work through that list.

A couple years ago I'd have filed most of them under "fix eventually." Now an attacker can discover esoteric or new holes for almost nothing. Someone can point a model at the internet, look for any box it can get into, and use that box as a staging ground for attacking something else. Even a server holding nothing but public posts is worth something as a place to attack from. Being boring used to be a decent defense for a small company's servers. It isn't much of one anymore.

## The defense got smarter too

The intelligence that finds holes can also assess your setup and close them, and now it's available to people who never had an IT department.

When the PHP disclosure was announced, I was helping a family business with a DigitalOcean account full of sites that had never been updated, some on Linux versions that lost support years ago. They were so far behind that updating had been blocked, so we'd talked about a migration at some point. It happened overnight instead. I gave Claude DigitalOcean and Cloudflare API keys with broad permissions and let it work. It spun up new servers, migrated the apps, set up a shared database server, upgraded PHP ahead of the release, and practiced compiling PHP from source for the site that needed it.

When the release came, Claude was watching the PHP site and the Linux package repositories. For some sites it built the patched PHP from source. For others it waited for the official packages, checking every ten minutes. When they appeared, the downloads failed, probably because everyone on earth was pulling them at once, so it set a retry loop to try every minute for the next hour. Eight hours after the first official patches shipped, every site was patched. I was barely involved. Maybe it made a mess somewhere. It was already a mess, and there's no way this is worse.

A smaller example. In September I wrote about [a spike in my newsletter subscribers that looked suspicious](https://saadiq.xyz/newsletter/five-subscribers-from-nowhere/). Claude traced them to bots coming through Tor, a network that bounces traffic through volunteer relays so the site on the other end can't see where it came from. It's a legitimate privacy tool and also a favorite of spammers. Claude offered to remove the fake subscriptions, block that pattern of signup, and block traffic from Tor exit nodes, the relays where Tor traffic comes out onto the regular internet. I said yes to all three. I couldn't have diagnosed it before, let alone fixed it.

Then this morning, Tailscale. No patch yet. I asked Claude to research the flaws, look at my setup, and tell me where I was exposed. The worst bug needs Tailscale SSH with port forwarding turned on, plus an attacker who already controls a device the network trusts. I don't use Tailscale SSH and I'm not forwarding ports. Upgrade when the fix ships, but this isn't a red alert.

From there, I realized one machine on my private network wasn't fully under my control. It's the server that runs my website, rented from DigitalOcean and sitting on the open internet. My first instinct was to pull it off the network entirely. Claude gave me the settings to keep it on with just the access it needs. I can still reach it, and it can't reach anything else of mine. That's the level of polish I'd always wanted and never would have gotten to. Before these tools, it was too much work to ever happen.

## Can we slow down?

People also ask whether we should just slow down. I'd like that. I don't see how it would work. Every lab and every country wants everyone else to slow down, and the incentive to defect from any agreement is enormous. I'm not moved much by the argument that China will eat our lunch, either. As someone online pointed out, we seem very concerned about China beating us in AI and much less concerned about China beating us in solar, electric vehicles, and rail.

## Where I land

So I'm not spun around the axle about doom. The ground between here and wherever we land is going to be bumpy. Every capability that makes a server easier to break also makes it easier to fix, and one person with a laptop can now run a security operation that used to take a department. Society has to recalibrate around that. Whether it goes badly depends on what people decide to do with these tools, which has been my worry all along.