PHP2Shell Won't Be the Last Big AI Cybersecurity Risk
PHP2Shell Won't Be the Last Big AI Cybersecurity Risk
2 hours ago•Odd Lots•Bloomberg
Podcast49 min
Listen to Episode
Note: AI-generated summary based on third-party content. Not financial advice. Read more.
Quick Insights

The strongest actionable theme is cybersecurity: consider diversified exposure to companies that help organizations contain intrusions and secure complex systems, but the discussion provides no specific stock picks or valuations. Treat AI as a double-edged force: it may increase demand for security tools while adding risks for companies adopting AI, so favor businesses with clear security and governance practices. No specific buy or sell recommendations, price targets, or timeframes were provided for OpenAI, Wiz, Calif, or SpaceX.

Detailed Analysis

Cybersecurity Sector

  • The discussion presents cybersecurity as an area facing increased urgency as AI makes it faster to find vulnerabilities and develop exploits.
  • In one example, attackers reportedly spread through a bank’s network from initial access to widespread compromise in about a day, compared with roughly a month for the firm’s prior response scenarios.
  • The speakers said the time between a vulnerability being disclosed and a usable patch reaching customers is shrinking, creating a risk that attackers exploit flaws before systems are updated.
  • They also warned that security products themselves can have vulnerabilities, so buying a cybersecurity tool alone does not guarantee protection.

Takeaways

  • Investors may want to watch whether cybersecurity providers can help customers respond at machine speed, limit the spread of intrusions, and secure complex systems—not just identify threats.
  • The discussion supports a potential long-term demand theme, but it does not identify specific publicly traded cybersecurity stocks, valuations, or recommendations.
  • Risks mentioned include faster attacks, unpatched software, complex enterprise environments, and the difficulty of shutting down critical systems such as bank networks.

Artificial Intelligence (AI)

  • AI is accelerating both vulnerability discovery and exploit development. The guests said work that could take a team months may now take one person days, and in some cases AI can help attackers move through a network rapidly.
  • The speakers said AI currently appears to help attackers more than defenders, though they expect defenders to use AI to build and operate more secure systems over time.
  • They cautioned that AI coding tools can also enable hacking, since systems capable of coding, debugging, and controlling computers have capabilities that can be used offensively.
  • The discussion described the current “best hacker” as a combination of human expertise and AI, while noting that this balance could change quickly.

Takeaways

  • AI has a dual-use investment profile: it may increase demand for security tools while also increasing security costs and risks for companies adopting AI.
  • When assessing AI-related businesses, consider whether security and governance are part of the product and operating model; the transcript does not establish that any particular AI company has solved these risks.
  • No price targets, investment timelines, or specific AI-stock recommendations were mentioned.

OpenAI

  • OpenAI funded Calif’s work to investigate vulnerabilities in open-source software through its program supporting security research and maintainers.
  • OpenAI was also discussed in connection with a security incident involving compromised points within its network. The guests used the incident to illustrate the scale and speed of AI-enabled threats.

Takeaways

  • The transcript highlights both OpenAI’s role in funding defensive security work and the security challenges facing AI companies.
  • It provides no valuation information or recommendation to buy or sell OpenAI shares.

Wiz

  • Wiz was identified as another company involved in uncovering the PHP vulnerability, alongside Calif.
  • The episode did not provide details about Wiz’s products, financial performance, or investment prospects.

Takeaways

  • Wiz is relevant to the cybersecurity theme discussed, but the transcript does not provide enough company-specific information for an investment assessment or recommendation.

Calif

  • Calif was described as a hacking firm that tests systems for vulnerabilities and helps organizations with security work.
  • The company participated in the PHP vulnerability research funded by OpenAI and also assisted banking clients after AI-enabled intrusions.
  • The guests emphasized that AI has shortened the time needed to find vulnerabilities and build exploits, while human expertise remains important.

Takeaways

  • Calif’s work illustrates possible demand for specialized security research and incident response as AI accelerates cyber threats.
  • The transcript does not give Calif’s financial details or identify it as a publicly traded investment.

PHP and Open-Source Software Infrastructure

  • Researchers found a serious vulnerability in PHP, a coding language the hosts said is used by a large share of websites.
  • The PHP Foundation had reportedly identified the issue earlier but did not fix it at that time because the fix was costly and could disrupt functionality or introduce other problems.
  • The guests said vulnerabilities can also exist in heavily scrutinized software, including browsers, challenging the assumption that mature systems are necessarily well protected.

Takeaways

  • Companies dependent on legacy or widely used software may face security and operational risks, including costly upgrades and disruption from patches.
  • The transcript points to software maintenance and security as important business considerations, but it does not identify a direct investable PHP opportunity or make a specific recommendation.

SpaceX

  • A Bloomberg Tech Minute segment said some SpaceX employees may receive the right to buy shares or receive restricted stock units that vest over time.
  • This was presented as employee compensation, not as a public investment opportunity. No SpaceX ticker, share price, or investment terms for outside investors were given.

Takeaways

  • The mention indicates that SpaceX employees may have access to company equity, but the transcript offers no basis for evaluating SpaceX as an investment.

Ask about this postAnswers are grounded in this post's content.
Episode Description
Earlier this year, cybersecurity researchers discovered a vulnerability in PHP, an open-source coding language used in roughly 70% of the world's websites, that had been lying dormant for a long time, and if exploited, could have led to disaster. And the researchers only understood the extent of this bug through the use of frontier AI models. Today, we talk to two staffers at Calif (CEO Thai Duong and engineer Bruce Dang), the cybersecurity firm that was among the first to discover the PHP vulnerability. Their firm partners with the major AI labs and neoclouds, and they help these companies test models and look for vulnerabilities in their infrastructure. Duong and Dang tell us how Calif uncovered the PHP hack, what the firm exactly sells, and what the future of cybersecurity looks like in the age of AI. Read more: How AI Is Making Cyberattacks a Bigger Threat Japan’s Cyberattack Surge Tests Its Push to Strengthen Defenses Only http://Bloomberg.com subscribers can get the Odd Lots newsletter in their inbox each week, plus unlimited access to the site and app. Subscribe at  bloomberg.com/subscriptions/oddlots Subscribe to the Odd Lots Newsletter Join the conversation: discord.gg/oddlots See omnystudio.com/listener for privacy information.
About Odd Lots
Odd Lots

Odd Lots

By Bloomberg

<p>Bloomberg's Joe Weisenthal and Tracy Alloway explore the most interesting topics in finance, markets and economics. Join the conversation every Monday and Thursday.</p>