Ai

In 2024 our audit of PHP's core reported two flaws in the exact code behind php2shell and filed one as a crash. Two years later, three teams independently turned the same defect into a working attack in six weeks. The code never changed. The cost of looking at it did.

Regular pentests, also known as black box pentests, require auditors to infer how a system works through reconnaissance, experimentation, as well as trial and error. A white box pentest gives them direct access to most of that information instead.

Fable 5 wrote a booting, NT-shaped kernel in Rust in 38 minutes. The code is impressive; the signal is what it tells us about AI-authored trust, and the verification frontier that decides whether the internet's critical infrastructure gets rewritten by models.