IEEE Spectrum: "AI is forcing us to pay off 40 years of technical debt"

The piece uses the PHP2Shell vulnerability as an example: AI tools are getting very good at finding old bugs in old code, which means decades of 'it works, don't touch it' are suddenly exploitable at scale. Attackers get the same tools as defenders. Is your team actually seeing more legacy CVEs land, or is this mostly a headline?