When European cybersecurity agencies tell organizations to consider taking exposed applications off public networks, the software underneath those applications suddenly becomes everyone's concern. That was the warning surrounding PHP2Shell on October 21. The agencies urged organizations to patch and consider isolation when immediate remediation was impossible. ENISA

My reaction is that we need to connect two conversations we often have separately: what AI is doing to cybersecurity, and how we pay for the open-source software our businesses depend on.

Better tools can help us discover dangerous weaknesses. Whether that translates into a safer internet depends on our ability to act on what they find.

PHP2Shell involved two critical flaws in PHP itself, the runtime beneath many web applications. Under the right conditions, an attacker could execute code without logging in. PHP shipped emergency fixes on October 21.…