All-In · Oct 23, 2026 · 1h 43m · 95m saved
With Nikesh Arora, Chairman and CEO of Palo Alto Networks
Photo via paloaltonetworks.com
A PHP vulnerability rated 9.2 out of 10, dubbed PHP2Shell, leaked ahead of its scheduled patch date this week. It triggered precautionary shutdowns across European government websites, Wikipedia, and warnings from the NSA and FBI. Most companies facing that would scramble to patch and move on. Nikesh Arora, chairman and CEO of Palo Alto Networks, told the All-In podcast's hosts there's a second option almost nobody considers: block the attack at the network's edge without ever touching the vulnerable code.
"There's two ways to solve this problem... you can go in and patch the vulnerability... The other is you can actually put it in a perimeter defense product like ours. We put the patch there. It's a virtual patch." — Nikesh Arora
Nikesh runs the company now selling that virtual patch to customers scrambling to cover PHP2Shell. He said the underlying bug was only found after researchers finally threw sustained AI effort at a flaw identified years earlier but long considered too complex to crack.
The full episode is covered here so you can skip it. 1 hour 43 minutes of audio, 8 minutes of reading.
Here are the 8 takeaways that matter.
Key Takeaways
About 1% of companies drive 90% of AI token spending, and 80% of that comes from unprofitable, VC-backed startups, Chamath Palihapitiya says
He calls the resulting loop between VCs and the startups they fund "circularity"
One bank's CIO team told Chamath's research team it built six independent, from-scratch data centers rather than lean further on AWS and GCP
The PHP flaw behind the panic is rated 9.2 out of 10 and affects an estimated 70% of websites
Hackers reverse-engineer a patch itself to find who hasn't installed it, Nikesh says, which is why Palo Alto also sells a "virtual patch" at the perimeter
Banks can't tell an AI agent from its owner logging in, Nikesh says, leaving who's liable for an unauthorized transaction unresolved
Even if every company embraced AI today, Nikesh says, "there's not enough compute in the world" to meet the demand
Cybersecurity runs 4 to 10% of a typical IT budget, Nikesh says, higher at banks and government agencies
1. The AI Bubble Debate
Jason Calacanis, the All-In podcast's co-host, opened the show on Citadel founder Ken Griffin's remark that AI is "almost certainly" a bubble, paired with a rough week for AI-linked stocks. Chamath Palihapitiya, another co-host, countered with a specific breakdown from a call his Social Capital research team had with Ramp's chief economist.
1% of companies account for 90% of AI token spending, Chamath says
"About 1% of companies represent 90% of AI spending. So that's tokens. And of that 90%, 80% of them are from unprofitable VC-backed companies." — Chamath Palihapitiya
He described the resulting loop in blunt terms: a startup spends venture money on other companies' AI products, calls that spending "revenue traction," and uses it to raise its next round from the same backers.
Chamath calls the loop between VCs and their startups "circularity"
"VCs raised from pension funds and LPs and foundations and family offices. They put money into a startup... part of growing is by consuming other people's AIs... Those folks then say, 'Hey, look how well we're doing.' Raises a bunch of money from the same VCs. And it's just this circularity." — Chamath Palihapitiya
Jason pushed back that venture money rushing into a technology is historically a sign it's working, not a bubble sign. He pointed to earlier rushes into cloud computing and Facebook ads as the same pattern repeating.
