What did Nikesh Arora say about the PHP2Shell exploits and the AI cyber panic on All-In?

Nikesh Arora said attacks like the PHP2Shell flaws will come more often than every 10 days. The flaws had been suspected for years, he said, but only persistent AI compute cracked them, and once a patch ships, hackers reverse-engineer it to hit anyone who has not applied it. Companies running old PHP versions must take sites down to upgrade them or block attacks with a virtual patch at the perimeter.

Jason Calacanis said PHP powers about 70% of websites and the flaws were rated 9.2 out of 10.
A coordinated patch planned for 22 October 2026 was released a day early after details leaked.
Arora advised firms to assume they will be breached and to pool their signals so they can spot anomalies quickly.

▸In their words

“Actually, the PHP problem was solved by persistent compute.” Nikesh Arora · at 18:53 — open in the transcript →

Source: our own transcription of the episode. The full conversation is on All-In with Chamath, Jason, Sacks & Friedberg (2026-10-23). Read the whole episode summary →

▸More from this episode

Q1What did Chamath say about Ken Griffin's AI bubble warning on All-In?Q3Who is liable when an AI agent drains a bank account, according to the All-In hosts and Nikesh Arora?Q4What does Nikesh Arora think about AI models with their guardrails removed?Q5Why does David Friedberg say France is a warning for the United States?Q6What did Chamath say about bond vigilantes and the riots in France?Q7What did Jason Calacanis and David Friedberg argue about the minimum wage on All-In?

Ask your own recordings. Upload a podcast, a lecture or a meeting and ask it questions like this one. Transcribe with Whipscribe →