What are the key takeaways from this Odd Lots episode?

Key insights include: **AI Exploitation Speed:** AI has collapsed the window between patch release and active exploitation to near-zero. Attackers now monitor open-source repositories like GitHub in real time, and once a patch appears, AI agents can reverse-engineer the underlying vulnerability and build a working exploit within hours — a process that previously took skilled teams weeks or months.; **Technical Debt Scale:** Systems previously considered well-hardened are revealing far more vulnerabilities under AI-assisted analysis than expected. Chrome, despite years of heavy security investment and layered exploit mitigations, yielded roughly 1,000 vulnerabilities when AI was applied — approximately 10 times more than security engineers had anticipated before AI-assisted auditing.; **Minus-One-Day Vulnerabilities:** A new vulnerability category has emerged between patch development and user deployment. When open-source projects fix bugs publicly on GitHub before users can upgrade, attackers exploit that gap. Organizations running PHP, Python, or Java should monitor patch release timing and prioritize emergency upgrades within hours, not standard maintenance cycles.

What did Tai Yun and Bruce Dang discuss on Odd Lots?

Calif CEO Tai Yun and engineer Bruce Dang explain how AI transformed cybersecurity offense and defense, using their discovery of the PHP vulnerability — affecting 70% of websites — as a case study in how AI compresses exploitation timelines from months to hours. Key topics include: **AI Exploitation Speed:** AI has collapsed the window between patch release and active exploitation to near-zero. Attackers now monitor open-source repositories like GitHub in real time, and once a patch appears, AI agents can reverse-engineer the underlying vulnerability and build a working exploit within hours — a process that previously took skilled teams weeks or months.; **Technical Debt Scale:** Systems previously considered well-hardened are revealing far more vulnerabilities under AI-assisted analysis than expected. Chrome, despite years of heavy security investment and layered exploit mitigations, yielded roughly 1,000 vulnerabilities when AI was applied — approximately 10 times more than security engineers had anticipated before AI-assisted auditing..

How long is this episode of Odd Lots?

This episode is 49 minutes long. SignalCast provides an AI-generated summary so you can get the key insights in about 3 minutes.

Odd Lots

PHP2Shell Won't Be the Last Big AI Cybersecurity Risk

October 30, 2026

49 min episode · 2 min read

Tai Yun,Bruce Dang

Episode

49 min

Read time

2 min

Topics

Investing, Leadership, Artificial Intelligence

AI-Generated Summary

Published Oct 30, 2026

Key Takeaways

✓AI Exploitation Speed: AI has collapsed the window between patch release and active exploitation to near-zero. Attackers now monitor open-source repositories like GitHub in real time, and once a patch appears, AI agents can reverse-engineer the underlying vulnerability and build a working exploit within hours — a process that previously took skilled teams weeks or months.
✓Technical Debt Scale: Systems previously considered well-hardened are revealing far more vulnerabilities under AI-assisted analysis than expected. Chrome, despite years of heavy security investment and layered exploit mitigations, yielded roughly 1,000 vulnerabilities when AI was applied — approximately 10 times more than security engineers had anticipated before AI-assisted auditing.
✓Minus-One-Day Vulnerabilities: A new vulnerability category has emerged between patch development and user deployment. When open-source projects fix bugs publicly on GitHub before users can upgrade, attackers exploit that gap. Organizations running PHP, Python, or Java should monitor patch release timing and prioritize emergency upgrades within hours, not standard maintenance cycles.
✓AI Coding Equals AI Hacking: Any AI model capable enough to automate software development is inherently capable of hacking. Because coding agents must understand code, debug systems, and control computers, they functionally meet the definition of a hacker. Organizations cannot expect AI vendors to ship capable coding models while simultaneously restricting offensive security capabilities — the two are inseparable.
✓Centaur Hacker Era: The most capable threat actor today is a human-AI combination, mirroring Garry Kasparov's "centaur chess" concept after Deep Blue's 1997 victory. Calif observed banking clients compromised network-wide within 24 hours of initial breach — a lateral spread that previously took a month. Defenders should assume AI-assisted attackers operate at machine speed, not human speed.

What It Covers

Calif CEO Tai Yun and engineer Bruce Dang explain how AI transformed cybersecurity offense and defense, using their discovery of the PHP vulnerability — affecting 70% of websites — as a case study in how AI compresses exploitation timelines from months to hours.

Key Questions Answered

•AI Exploitation Speed: AI has collapsed the window between patch release and active exploitation to near-zero. Attackers now monitor open-source repositories like GitHub in real time, and once a patch appears, AI agents can reverse-engineer the underlying vulnerability and build a working exploit within hours — a process that previously took skilled teams weeks or months.
•Technical Debt Scale: Systems previously considered well-hardened are revealing far more vulnerabilities under AI-assisted analysis than expected. Chrome, despite years of heavy security investment and layered exploit mitigations, yielded roughly 1,000 vulnerabilities when AI was applied — approximately 10 times more than security engineers had anticipated before AI-assisted auditing.
•Minus-One-Day Vulnerabilities: A new vulnerability category has emerged between patch development and user deployment. When open-source projects fix bugs publicly on GitHub before users can upgrade, attackers exploit that gap. Organizations running PHP, Python, or Java should monitor patch release timing and prioritize emergency upgrades within hours, not standard maintenance cycles.
•AI Coding Equals AI Hacking: Any AI model capable enough to automate software development is inherently capable of hacking. Because coding agents must understand code, debug systems, and control computers, they functionally meet the definition of a hacker. Organizations cannot expect AI vendors to ship capable coding models while simultaneously restricting offensive security capabilities — the two are inseparable.
•Centaur Hacker Era: The most capable threat actor today is a human-AI combination, mirroring Garry Kasparov's "centaur chess" concept after Deep Blue's 1997 victory. Calif observed banking clients compromised network-wide within 24 hours of initial breach — a lateral spread that previously took a month. Defenders should assume AI-assisted attackers operate at machine speed, not human speed.

Notable Moment

Calif described responding to two banking clients breached simultaneously in recent weeks. Attackers who gained network access on Monday had spread to every system by Tuesday — a lateral movement timeline that human-led intrusions typically stretch across a full month, leaving defenders with no practical window to respond.

Know someone who'd find this useful?

Episode Transcript

00:00:02 Speaker 1: Bloomberg Audio Studios. Podcasts. 00:00:05 Speaker 2: Radio. 00:00:06 Speaker 3: News. 00:00:18 Speaker 4: Hello and welcome to another episode of the Oddbots Podcast. I'm Tracey Alloway. 00:00:22 Speaker 1: And I'm Joe Weisenthal. 00:00:23 Speaker 4: Joe, it's October. We're recording this on October 29th. 00:00:27 Speaker 5: Yeah. 00:00:27 Speaker 4: It is also Black October. Have you heard this term? 00:00:30 Speaker 5: Yeah. 00:00:31 Speaker 1: What does that mean? Have stocks gone down? 00:00:33 Speaker 2: No. 00:00:34 Speaker 4: Your mind immediately goes to markets. There are other worlds out there. We're going to be talking about the world of cybersecurity today because one of the reasons people are talking about Black October is we've had a number of recent security issues, the most prominent of which has been a bunch of vulnerabilities discovered in PHP, which is a coding language that apparently is used by 70% of websites in existence. We can get into that stat later. But the really interesting thing about this vulnerability being uncovered is AI was used to uncover it. And so the big question coming back to AI, there's a concern now that you have good actors who are maybe using AI to discover old vulnerabilities and trying to fix them. But you could also have bad actors who are using AI to exploit those same vulnerabilities. So we're back to the question of whether AI makes the internet safer or more dangerous. 00:01:29 Speaker 1: It makes it more dangerous. No, I have no idea. Ever since essentially Anthropic announced that they had this model called Mythos and now it's Project Glasswing, which was rolled out to companies to use for defensive purposes before it was available to the general public, there has been much more awareness of cybersecurity issues as it relates to AI. And there are many things that people debate about AI and some of these bigger existential questions. Pretty much everyone agrees cybersecurity good, more cybersecurity good. I will say I know very little about the world of cybersecurity. I don't know what, for example, a cybersecurity company actually sells. I don't know how if I were buying cybersecurity, I would know whether it's working or whether no one had tried to hack me or not or something like that. I need to learn a lot more, but it's absolutely true about the uptick in the volume of hacks. 00:02:19 Speaker 4: There are hackers out there right now taking notes going, Joe doesn't know anything about cybersecurity, probably doesn't have a VPN. 00:02:25 Speaker 5: I don't. 00:02:26 Speaker 1: That's why my vibe coding projects, I don't want to ever, I have yet to build anything with an account because I don't want to like have to think about that. So it's just like, I don't want to count information with anyone. But I have as a user of technical products, over the last several weeks, you …

Get the full transcript (7,939 words) + summary by email — free

One-time email with the complete transcript and AI summary of this episode. No account needed.

One email, no spam. We’ll also show you what SignalCast does.

Browse all Odd Lots transcripts →