Breaking Down PHP2Shell with Sagi Tzadik & Thai Duong

It's interesting that Um, it almost sounds like there are a few things, a few impacts of AI here.

Like one is that it makes these types of vulnerabilities perhaps easier to discover, like arguably perhaps they couldn't have been discovered before, but then, you know, you say they actually did find an issue like this or, or even the same issue a few years ago, but they didn't consider it exploitable.

So beyond the discovery aspect, you could also say that AI is also changing what might be like the severity of a vulnerability just by proving that something that previously wasn't considered exploitable is now suddenly considered exploitable, which I think is fascinating.

I also find it interesting that the fact that multiple parties found this at the same time, do you think that has to do with the advancement of models of the time? Or is it more of a coincidence?

Yeah, I think it could be both, right? Basically, everybody was using the same model.

And I think what happened was there was WordPress to Shell.

And that basically... trigger interest in Bixby in many companies.

Because if you really want to do better than WordPress to sell, then you need to get deeper into the engine, right? This is

not exactly what we were thinking.

We love that work.

It's beautiful.

But as researchers, we want to do something new and more powerful.

So that's one of the motivations.

And I'm not saying that that's the only motivation.

And I think the models, they know about this mug family because the data and everything is on the internet.

It's just that it needs somebody to actually trigger this specific knowledge.

And I think maybe we're just lucky.

Maybe we just like, because we know about this book last maybe because Stephen Escher is at Calif and Brian is a PHP historian.

So we trigger this, you know, neuron within the models.

And then we found the vulnerability.

But I think, yeah, I believe with this, I strongly believe after the knowledge that there are vulnerabilities like this in PHP are published, then people will be able to quickly reproduce and even do exploits.

It will show that it's just a matter of whether you know what you're looking for.

If you know, then you can ask the model.

And to your second point about AI can actually help speed up exploitation, I think it's not just speeding up, right? It allows us to overcome difficulties.

It's not like we kind of do this manually.