Your oldest, ugliest code is about to get a surprise audit from a tireless, inhuman intern. And it's going to find things you completely forgot existed.
As recently reported on Hacker News, an AI model found a critical remote code execution vulnerability in php2shell, a project that hasn't been touched in over a decade. The vulnerability itself was almost a cliché, a classic PHP footgun involving the extract() function on a $_GET request. It's the kind of thing that gives engineers who started in the early 2000s a nervous twitch. But this isn't a story about a clever AI or a nostalgic bug. It's a story about technical debt, and how the bill is finally coming due for everyone.
For years, we've gotten away with letting old codebases quietly rust in forgotten corners of our infrastructure. The logic was simple: if it isn't broken and no one is complaining, don't touch it. That logic is now officially obsolete.
The AI Spotlight Effect
That ancient PHP script, that unmaintained internal tool, that Perl CGI script from 1998 that somehow still processes a web form, they've all been protected by obscurity. Human security researchers and even traditional static analysis tools have limited time and resources. They focus on the high-value targets, the main application, the active repositories. They don't have time to go spelunking through a ZIP file of webapp_v2_final_FINAL.zip on a dusty server.
AI models don't have that limitation. They don't get bored. They don't need a budget approved for a deep dive. They can be pointed at a billion lines of code and asked to find every instance of a known vulnerability pattern. They aren't 'thinking' in a human sense, they are performing a pattern-matching audit at a scale and speed we've never had before. This is the AI Spotlight Effect: no code is safe in the dark anymore.
The php2shell bug is a perfect example. The AI didn't need to understand the application's business logic. It just needed to recognize this toxic pattern:
// This is the core of the vulnerability.
// It takes any key-value pair from the URL query string...
// ...and turns it into a variable in the current scope.
// So, a URL like ?authenticated=1 creates a $authenticated = 1 variable.
extract($_GET);
// Later in the code, a check might look for $authenticated.
if ($authenticated) {
// Grant access
}
A human might miss this if they're just scanning the file. An AI trained on thousands of examples of variable injection vulnerabilities will flag it instantly. Now, imagine this capability pointed not at a single open-source project, but at the entire public-facing internet, or even at an organization's entire collection of private code repositories. Every lazy shortcut and every 'temporary' fix from the last 40 years is now on the table for discovery.
Your Old Tech Debt Strategy Is Now Obsolete
Most engineering teams have a technical debt 'strategy' that's really just managed neglect. It involves a JIRA backlog epic named 'Tech Debt' filled with tickets that get perpetually deprioritized in favor of new features. We justify this with arguments about business value and impact. Why spend 80 hours refactoring a legacy module that works 'fine' when we could be shipping a new feature for our biggest customer?
It was a reasonable tradeoff. The risk of an unknown vulnerability in an obscure part of the system felt low, and the cost of finding and fixing it felt high.
AI fundamentally inverts this calculation. The cost to find the vulnerability is now approaching zero. Malicious actors can and will automate this discovery process. Suddenly, the potential cost of not fixing the issue (a critical data breach, a server compromise) skyrockets. The 'if it ain't broke, don't fix it' mantra only works when you don't have someone (or something) actively and cheaply trying to break it.
Your tech debt is no longer a passive, internal concern. It is an active, exploitable attack surface. And you probably don't even know how large that surface is.
An Action Plan: Archive, Isolate, or Annihilate
This isn't a call to panic and rewrite everything. That's not practical. It's a call for a new, pragmatic approach to technical debt triage in the age of AI. It's about getting ahead of the automated auditors.
Step 1: Conduct an Honest Inventory
You cannot fix what you don't know you have. Your first job is to become an archaeologist of your own infrastructure.
- Scan your servers for old, unmanaged code directories.
- Use GitHub or GitLab APIs to find all repositories in your organization, especially archived ones that might still have code deployed somewhere.
- Talk to your veteran engineers. Ask them about the skeletons in the closet, the systems everyone is afraid to touch.
Create a simple risk registry. A spreadsheet is fine. List the application, its language/framework, its last-known update, and its business purpose. This is your treasure map.
Step 2: Run the AI Scanners
Now, you point the spotlight at your own systems before someone else does. Use modern security tools on these old codebases. Services like Snyk or GitHub's own CodeQL are great starting points. But you can also use LLMs directly.
Don't just ask 'is this code secure?'. Give it a specific task. For example, take a chunk of that old PHP code and prompt a model like GPT-4o or Claude 3:
'Analyze this PHP code for potential remote code execution or variable injection vulnerabilities, specifically related to the use of global variables like $_GET, $_POST, and functions like extract() or eval(). List any potential issues and explain the attack vector.'
You'll be surprised what they find. The goal isn't a perfect report. The goal is to quickly identify the most egregious, textbook vulnerabilities that an automated scan would catch.
Step 3: Archive, Isolate, or Annihilate
Once you have a list of vulnerable legacy systems, you have three choices. For each system, you must pick one.
Archive: If the system is no longer in use, the choice is simple. Turn it off. Take the server offline. Archive the code in a read-only repository. Deletion is the most effective security patch. Your inventory from Step 1 is critical here to prove it's no longer needed.
Isolate: If the system is still needed but can't be easily fixed (e.g., a black-box system from a vendor who no longer exists), you isolate it. Treat it like nuclear waste. Put it on its own firewalled network segment. Place it behind a strict Web Application Firewall (WAF) with rules specifically designed to block the discovered vulnerabilities. Strip its database and OS permissions down to the absolute bare minimum. You're building a container to limit the blast radius when (not if) it gets compromised.
Annihilate (and Rebuild): If the system is both critical to the business and fundamentally insecure, you finally have the business case you've always needed for a rewrite. This isn't a 'nice-to-have' modernization project anymore. It's a critical security remediation project. The AI audit report is your proof. Frame the project not in terms of shiny new tech, but in terms of mitigating a specific, credible, and potentially company-ending threat. 'If we don't replace this system, we are one automated scan away from a breach.' That's a statement that gets a budget approved.
What This Means For Your Team
This isn't just a technical problem, it's a strategic shift. Here's what you need to start thinking about now:
- AI is your new, involuntary security auditor. It will find the problems you've been ignoring, whether you want it to or not.
- The 'if it ain't broke' philosophy is dead. The cost of discovery is now so low that any potential vulnerability must be treated as a ticking clock.
- Your true attack surface is everything you've ever deployed. Not just the code in your active CI/CD pipeline.
- This is your leverage. Use the threat of AI-driven vulnerability discovery to finally get the resources to pay down your most critical technical debt. It's the most compelling business case you'll ever have.
The first step isn't a massive rewrite. It's an honest inventory. Spend one afternoon this week mapping out your team's forgotten applications. That's the map that shows you where the AI debt collectors will knock first.
Building something in this space? AgileStack helps teams ship enterprise-grade software without the consulting-firm overhead. Book a 30-minute call and tell us what you're working on.