AI Won't Pay Off 40 Years of Technical Debt; It Sends the Bill
AI can inventory four decades of technical debt but cannot decide what to delete, and the same list that helps a team is a map for whoever attacks it next.
PHP2Shell is being framed as a wakeup call for AI in cybersecurity, and a parallel argument says models are now forcing a reckoning with four decades of accumulated debt. Neither headline is wrong about the direction. Neither is a plan. Both point at the same shelf: parsers, upload handlers, session code, the file nobody has opened since it was written, the test that only passes on one machine.
A model that reads an old codebase finds every shortcut in it. Anyone else can point a model at the same files, so the bill arrives twice: once as remediation, once as exposure. AI retires nothing. It moves the due date forward and drops the statement where the whole team can see it. Nothing on that list is news to the people who wrote it.
The fine print on the AI-fixes-legacy pitch is that the model is a reader, not a payer. Paying means deciding what stops existing: the endpoint nobody calls, the duplicate validation, the key that outlived its service. A model will refactor all three and keep them. Buy a model, call it a remediation program, and you get a faster copy of the same system, debt included.
So give AI one job: produce the inventory. Point it at the repositories, ask what parses untrusted input, then have a human argue each entry down to keep, rewrite, or kill. What comes out is a spreadsheet with three columns — service, parser, owner — and every row a decision postponed for years. Fill the owner column this week; a name per row is the part no model can supply.