Podcast Covers PHP2Shell Flaws, Exposed Legacy Servers and AI Scambaiting
· 14:35 · Watch on YouTube ↗
Summary
The hosts discuss Apate AI’s AI personas engaging scammers to gather fraud intelligence, then cover PHP2Shell’s two critical unauthenticated RCE flaws, VirusTotal’s estimate of about 750,000 public IPs running end-of-life PHP, and mitigation advice.
Key points
- Apate AI’s platform uses AI-generated victim personas to answer scam calls and phishing texts, engaging fraudsters to collect intelligence such as payment routes and scammer infrastructure.
- The hosts say pilot programs handled millions of automated conversations and collected hundreds of thousands of intelligence indicators; one reported persona kept a scam caller engaged for over 50 minutes.
- The episode describes CVE-2026-109618 as a request-cleanup handling flaw and CVE-2026-109619 as a heap use-after-free during state disposal. Together, they reportedly enable unauthenticated code execution in a web-worker process under affected configurations; the stated CVSS score is 9.2.
- The hosts report that the flaws may have existed in the PHP codebase for over a decade and say AI-assisted analysis mapped the multi-stage exploit chain.
- VirusTotal’s reported internet scan found about 750,000 public IP addresses running end-of-life PHP versions, including versions as old as PHP 5.4.
- Suggested mitigations include disabling session.upload_progress.enabled and restarting the web service, upgrading to a supported PHP version, and protecting end-of-life servers from exposure. The hosts caution that WAF rules may not help if attackers reach an origin IP directly.
- The hosts characterize exploitation as difficult and caution that some reported proof-of-concept successes did not work when tested.
Article Details
- Topics
- [02:30] Apate AI’s automated scambaiting and fraud-intelligence collection
- [06:29] PHP2Shell emergency security releases and affected configurations
- [07:32] Technical descriptions of CVE-2026-109618 and CVE-2026-109619
- [08:04] Reported age of the flaws and AI-assisted vulnerability discovery
- [09:00] VirusTotal’s scan of exposed, end-of-life PHP servers
- [10:54] Mitigations for affected PHP deployments
- [11:30] Exploitability caveats and advice to patch or upgrade
CVE
People
Dave BalesPodcast speaker who discusses Apate AI’s scambaiting approach and explains the PHP2Shell vulnerabilities and mitigations.Nick BradleyPodcast host who introduces and summarizes the episode’s cybersecurity topics, including PHP2Shell and exposed legacy servers.Sophie CunninghamPodcast speaker who discusses Apate AI’s scam engagement and presents VirusTotal’s reported exposure findings and PHP mitigation advice.