Summary
Overview
Linus joins the WAN Show from China during an intense manufacturing tour while discussing critical tech news including a massive PHP vulnerability affecting 70% of websites, BioWare's closure, AI's impact on content creation, and the evolving landscape of self-hosting in response to increasingly invasive privacy policies from major tech companies.
PHP 2 Shell Vulnerability Crisis
A critical vulnerability affecting PHP versions 5.4 through 8.5 was disclosed early on an online forum before patches could be released, creating chaos. Cloudflare reported seeing thousands of exploitation attempts before the public announcement, which jumped to millions within hours. The vulnerability enables denial of service, remote code execution, and data exposure attacks, affecting nearly 70% of known websites including major frameworks like WordPress, Drupal, and MediaWiki.
- PHP Foundation announced patches for critical vulnerabilities affecting versions 5.4 through 8.5, impacting 70% of known websites
- Details leaked early on an online forum before patches were widely distributed
- Cloudflare saw thousands of exploit attempts in the 10 hours before announcement, jumping to millions within hours
- Vulnerabilities enable denial of service, remote code execution, and data exposure attacks
- An unsung hero, Andre Suri, has voluntarily maintained packages for unsupported PHP versions for 20 years
" In the 10 hours before PHP 2 shell was publicly announced, we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post-announcement, hundreds of thousands within two hours and millions now. "
" Internet too fast, everybody slow down. Stop all the downloading. "
AI Turbocharging Script Kiddies
The discussion explores how AI and large language models have dramatically lowered the barriers for exploiting vulnerabilities. People without any coding knowledge can now use LLMs to create exploits, effectively creating a new generation of "slop kiddies." This represents a fundamental shift in the threat landscape, with both offensive and defensive capabilities being enhanced by AI tools.
- Anyone can now create exploits using LLMs without ever opening a coding textbook
- AI is being used both offensively to find and exploit vulnerabilities and defensively to patch them
- The PHP vulnerability chain was discovered using AI tools, with researchers using GPT-5.6 and Gemini
- Script kiddies have evolved into "slop kiddies" using AI-generated attack code
" Without even without ever even cracking open a coding for dummies textbook literally anyone can just say hey I have an LLM without guardrails here's this new exploit um you know help me use it to benefit in some way "
📚 7 more sections below
Sign up to unlock the complete summary with all insights, key points, and quotes
Get this summary + all future The WAN Show episodes in your inbox
100% Free • Unsubscribe Anytime
Sign up now and we'll send you the complete summary of this episode, plus get notified when new The WAN Show episodes are released—delivered straight to your inbox within minutes.