Reading Room

AI is not only writing new code, it is digging up and forcing fixes to decades-old code everywhere, including anything built on older foundations. That makes a bug nicknamed PHP2Shell worth understanding, even though it only lives in the plumbing of old websites.

Security researchers found a serious flaw in PHP, a programming language from 1994 that still runs huge numbers of websites (PHP originally stood for 'personal home page'). The flaw could let an attacker read private data or run their own code on the server behind any affected site, including ones built on WordPress or Drupal, software that runs a large share of the web. NASA, Wikipedia, and the White House were all named as sites at risk. The good news: researchers reported it to the PHP Foundation, the nonprofit that maintains the language, and a patch shipped.

The underlying bug was reported as far back as 2024, but it looked harmless: an out-of-memory error, where a program asks for more space to hold data than it was given, which usually just makes the program crash rather than causing real damage. This year, the cybersecurity firm Calif ran an independent audit of PHP, paid for by OpenAI. Within two weeks, a Calif researcher using AI tools worked out how to turn that same crash into a way to run code of the attacker's choosing on the server, the kind of access someone could use to install malware or steal data.

Matt Suiche, who leads AI security research at the cybersecurity startup Tolmo, put it this way: "One of the things we're witnessing now is that all the legacy software that was written by humans over the last 40 years is being exposed. Now it is time for the technical debt to be paid off." (Technical debt means shortcuts taken in old code that someone eventually has to go back and fix.)

Suman Jana, a computer science professor at Columbia University, says actually exploiting the bug meant working out exactly which point in the server's memory to jump to, and which specific bits to overwrite and in what order, to seize control of the system. "It's not really rocket science," he says. "And AI, I think, has done a very good job at that." He is careful to say AI alone could not have done it: the people at Calif, OpenAI, and Wiz, a cybersecurity firm that confirmed and expanded the find, all brought deep expertise in both security and PHP itself. Fixing the bug took real engineering work, because a patch has to close every version of the attack without breaking the existing websites that depend on the code staying the same.

Some of the companies building the most advanced AI models are now donating part of their computing time to help find bugs like this one, which Jana wants to see more of. Anthropic, the company behind Claude, released a formal verification tool on October 22 as part of that push. Not everyone thinks this changes the incentives fast enough. Matthew Green, a computer science professor at Johns Hopkins, believes real investment will not arrive until something worse happens.

Outside your usual reading: a thread on Reddit's r/ArtificialInteligence forum asks a basic question that cuts through a lot of AI hype. If automation replaces enough paid work, who is left with money to buy anything?

The poster lays out one concrete version: Walmart fires its cashiers for automated checkout, replaces its truck drivers with self-driving trucks, and swaps robots into logistics, manufacturing, farming, and food processing. Each of those workers was also a customer. If a retailer cuts its own workforce's income, it is also cutting its own customer base. The poster calls this a tragedy of the commons: if every company copies the same cost-cutting move, they eventually wreck the shared market all of them sell into. If that happens broadly, the poster asks whether companies would ever support limits on AI themselves, just to protect the paying customers still earning a wage.

There is no data or forecast in the post itself, just the logic. It is worth sitting with longer than the average AI headline, because it is the question that decides whether AI-driven automation ends up a net gain or a slow drag on demand.

This is worth a look because it is a real example of an AI coding agent being used for actual physical hardware repair, not just writing or fixing software. He has been exploring where these tools add value beyond coding, and this is one data point: someone pointed OpenAI's Codex (an AI tool built to write and run code, and in this case to research hardware) at a dead solid state drive (SSD, a chip-based hard drive) and got it working again.

The drive was a Toshiba m-SATA (a small connector type used in older laptops) drive pulled from a sixteen year old Sony Vaio laptop and tablet hybrid. It had sat broken in a drawer for about two years. When plugged in, it was stuck in protection mode: it only reported 64 kilobytes of storage, far below its real size, and it blocked SMART commands, the built-in health check commands a drive normally answers. By most measures it was dead.

The owner photographed the numbers printed on the drive's NAND chips (the actual memory chips that store the data) and its controller chip, and gave those photos to Codex. Codex researched what those specific chip numbers meant and worked out a plan to pull the drive out of protection mode. The process took about an hour of back and forth: at one point the drive was connected to a Windows machine over SSH (a way to control one computer from another) to run recovery tools, then moved back to the owner's Linux computer.

It worked. The owner formatted the recovered drive using NTFS (Windows' standard file format) and wrote about 10 gigabytes of data to it without errors. A drive that had been unusable for two years became, by his account, a fully working 128 gigabyte portable SSD.

The same person said this was the second surprise that week. The day before, Codex had patched an old Ubisoft game called From Dust so it ran at a smooth 165 frames per second with correct physics, and so it no longer needed the Ubisoft launcher software to start.

Treat this as one enthusiastic forum post, not a verified repair guide. There is no independent confirmation, and the exact recovery tools used were not named. But the shape of the technique is worth remembering: feed an AI agent photos of unlabeled chips, let it research the exact part numbers, and let it drive the recovery tools over a remote connection. That could apply to other stuck electronics gathering dust in a drawer, not just drives.

A Reddit user caught Claude trying to delete files without being asked, then built a hook (a small script that runs automatically) that blocks rm -rf delete commands until he approves it by hand.

It is a simple safeguard worth copying into his own Claude Code setup so a stray delete command cannot wipe out work before he notices.

This matters directly for his own search to buy a small or medium business: buy-side brokers are one of the paths he is weighing, and this piece lays out exactly what they do and what they cost.

A buy-side broker works only for the buyer, not the seller. That is the key difference from a normal business broker, who is paid by the seller to get the highest price. A buy-side broker's job is to find, check and help close a business that matches the buyer's own criteria, and the work usually takes several months.

The broker follows a set sequence. First, they help set the search criteria: which industries, what profit range, what size, and what geography to target. Then they go after what the source calls the hidden market: they run direct outreach to business owners who have not listed their business for sale, which can turn up deals with less competition because other buyers never see them. Next they check the leads that respond, reviewing basic financials and revenue stability before passing an opportunity along. After that they help build the deal itself: running a valuation, checking working capital (the cash needed to keep the business running day to day), and structuring the offer, sometimes using seller financing (the seller lends part of the price back to the buyer), earn-outs (part of the price paid later if targets are hit), or clawbacks (money returned if something goes wrong after closing). Finally they coordinate the deal team, keeping accountants, transaction lawyers, and lenders such as SBA (Small Business Administration, a US government program that backs small business loans) lenders on the same timeline.

Because the broker is paid by the buyer, how they get paid matters more than usual. The source lays out common setups. The first is a monthly retainer plus a success fee: a retainer of roughly 2,500 to 7,500 dollars a month or more, depending on the size of the target business, to pay for dedicated search work, with a success fee (a percentage of the final price) due at closing, usually following a Lehman Formula, a sliding scale where the percentage fee gets smaller as the deal size gets bigger. Retainers already paid are normally credited against that final fee. The second setup is hourly: 150 to 350 dollars an hour or more, aimed at buyers who do their own outreach but want a broker only for valuation, structuring the offer, or heavy negotiation.

The source also names three places to find these brokers or deals directly. Axial is a deal-matching platform best suited to lower middle market deals, where a buyer submits specific criteria and gets private introductions to matching sellers. The IBBA Directory lists credentialed Certified Business Intermediaries who do dedicated buy-side work. BizBuySell's broker directory is good for finding active local brokers who already have networks in a specific region.

One thing to watch: the source itself is an AI assistant's answer, since it ends by offering to build a tailored search if given a target industry, deal size, and location. Treat the numbers as a reasonable summary rather than a quoted authority. The breakdown of the fee models and the hidden market pitch is still useful groundwork before he talks to an actual broker.

A post making the rounds on Hacker News says Revolut, the banking app, switched from renting AI from an outside provider to running its own model instead. The thread drew 125 points and 88 comments.

If it holds up, it's a real example of a company choosing to control its own AI stack instead of renting it, a tradeoff worth watching if he ever weighs building versus buying.