Cybersecurity Experts REACT to the php chaos... (and MORE)

Welcome to The Low Down, the best show on the internet for hackers Listen on Spotify! https://go.lowdownpod.com/spotify The Low Down is presented by Maze. LinkedIn:   / mazehq   X:   / maze_security   ---------------- Today we're talking about: PHP2Shell and the Disclosure Fight Ed and Matt are at OneCon in Las Vegas as PHP2Shell sets off a chaotic week. We unpack the research, shaky AI exploit claims, Chainguard's early fixes and whether disclosure timelines can keep up. Dan Lorenc and the PHP Foundation give different accounts of the rollout. https://calif.io/php2shell/   / danlorenc_i-wanted-to-share-what-happened-...   https://thephp.foundation/blog/2026/1... Kyle Polley's embargo discussion: https://x.com/kpolley/status/21130691... Your Certificate Authority's Private Key Was 4 One of eMudhra's private keys was literally four. We talk tiny keys, certificate trust, the company's exit from SSL/TLS and what happens when clients still trust compromised certificates. https://scotthelme.co.uk/eight-bits-o... https://emudhra.we-have-a-problem.com/ https://emudhra.com/en/press-release/... https://www.mitmproxy.org/posts/relea... Linux Bugs and the Power of a Pattern DirtyFrag, research credit and the latest kernel discussion lead into why Ed thinks AI is useful for spotting use-after-free patterns. DirtyFrag research: https://github.com/V4bel/dirtyfrag KSMBD background: https://docs.kernel.org/filesystems/s... Does AI Favor Attackers or Defenders? SentinelLABS' Tom Hegel makes the case for keeping powerful tools accessible to defenders. SentinelOne's Steve Stone explains why finding more bugs isn't the whole story: attack paths, speed, scale and the physics of an intrusion still matter. Meet the Threat Hunting World Champion Jason Walker joins us straight from his OneCon win. We get into his move from graphic design to security, CTF strategy, AI-assisted detection engineering and why the fundamentals still matter. OneCon: https://www.onecon.io/ ---------------- 00:00 Intro and OneCon in Las Vegas 04:31 PHP2Shell and AI exploit claims 15:59 Maze (sponsor) 17:14 Disclosure and the Chainguard controversy 27:12 Finding bugs with AI and research credit 31:39 eMudhra: weak private keys and certificate trust 42:37 Linux kernel bugs, fuzzing and use-after-free 46:31 Tom Hegel: AI for attackers and defenders 56:46 Steve Stone: AI attacks and security fundamentals 1:07:23 Jason Walker: threat hunting world champion ---------------- Follow Us!   / lowdown.pod   Ed / Low Level Instagram:   / lowleveltv   LinkedIn:   / lowleveltv   YouTube:    / @lowleveltv   Matt Johansen / Vulnerable U Instagram:   / mattjayy   LinkedIn:   / matthewjohansen   YouTube:    / @vulnerableu   Tom Hegel / SentinelLABS LinkedIn:   / tom-hegel   Steve Stone / SentinelOne LinkedIn:   / stevenstone618   Jason Walker / tresscross LinkedIn:   / jasonwalker777   Blog: https://tresscross.blog/