The Bottleneck in Cybersecurity Is Now Human

How AI turned a decade-old flaw in the language behind most of the web into a working exploit in days, and why the slowest part of PHP2Shell was everything that happened between finding the bug and fixing it

Author

Justin Wright
October 26, 2026 • Est. Reading Time: 6 minutes

Happy Monday!

Wiz: 'With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work.' (Source: Wiz)

On October 21, the PHP project shipped emergency patches for two critical flaws now known as PHP2Shell. PHP is the server-side language behind roughly 70% of websites where the language is known, including WordPress, Drupal, and the software that runs Wikipedia. The flaws allow an attacker with no account to run code on an affected server, and every PHP version back to 5.4, released in 2012, is affected by at least one of them. Websites in the US, the UK, and elsewhere went briefly offline to patch. Security teams started calling the month "Black October."

The headline version of this story is that AI found a catastrophic bug. That is true, and OpenAI put it plainly: "To our knowledge, frontier AI found these vulnerabilities before attackers did." Wiz, which found additional attack paths, called them among the most severe vulnerabilities "arguably in software history."

The reality is that AI made both ends of the security cycle dramatically faster: finding the flaw and defending against it at the edges of the internet. The part in the middle, deciding on a fix, coordinating its release, and getting millions of servers patched, still runs at human speed.

AI-assisted researchers at Calif, OpenAI, and Wiz found PHP2Shell, two critical flaws in the language behind roughly 70% of known websites, and turned decade-old weaknesses into working exploits in days. Cloud and CDN providers shipped protections fast. But the PHP Foundation says it first saw signs of the problem in 2024 and stalled on a fix for months, calling the delay "a structural failure." Its security work rests on one full-time employee and part-time contractors. Ultimately, humans remain the bottleneck.

TL;DR

What AI Changed

The vulnerable code was not new; the flaws sit in how PHP handles memory and errors, parts of the engine that nearly every request touches, and some of the underlying design choices date back more than a decade. What changed was the cost of proving they were exploitable.

Wiz describes the work required as chaining multiple bugs and adapting each attack to a target's memory layout through repeated testing and debugging, work it says sat "at the edge of what human researchers could practically achieve." Frontier models completely changed that math. Wiz used Gemini 4 Argon, GPT-5.6 Sol, and its own AI research tool, and concluded that "a single researcher completed in a week what previously would have taken a world-class team months of work."

Wiz put it directly: as AI reduces the effort needed to develop complex exploits, "vulnerabilities that once seemed impractical to exploit become viable targets." Complexity used to be a form of protection, but that protection is now fading.

Defense accelerated too: Calif began its audit on July 30 as part of OpenAI's Patch the Planet program and reported a remote code execution path on August 11. OpenAI independently reported the same root cause. Before disclosure, Cloudflare, AWS, Google, Fastly, Akamai, Vercel, and others prepared firewall protections for customers who could not patch immediately. The PHP security team itself now uses AI tools to validate incoming reports.

The Slow Part

The PHP Foundation published an unusually candid account on release day. In 2024, during PHP's first external security audit in years, a developer working for the Foundation found the first signs of the memory-handling problem behind one of the CVEs. A potential exploit was theorized, but no concrete attack path was found, and other issues with clearer impact took priority. The security team developed several competing fixes, each with a cost: breaking backward compatibility, creating new denial-of-service risk, or requiring changes to many third-party extensions. Operating by consensus, the team "struggled to choose between these and feared the repercussions of shipping the wrong choice," and the work "stall[ed] and restart[ed] repeatedly over months."

The Foundation's verdict: "We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources." It is now moving security decisions from consensus to majority vote.

The Foundation's executive director said it has "one full-time staff member (that's me) and 14 mostly part-time contractors." Meanwhile AI has multiplied the inbound workload. The team has published 15 CVEs since July 1 and worked through more than 100 reports that turned out to be invalid, duplicates, or not reproducible.

The Foundation's own summary is the thesis of this issue: "What tools cannot do is decide on the right fix for a long-standing design decision in the engine, weigh the compatibility trade-offs, and review the patch."

How the Disclosure Came Apart

Coordinated disclosure is the human process designed to give defenders a head start, and this one broke in three places. On October 20, the two CVE identifiers began circulating on forums and social media, with a wrong severity score and wrong release time. PHP moved its release up by a day. That evening, Calif, one of the reporting firms, mistakenly published a video showing its proof of concept working against real targets. It was deleted, but copies spread, and the Foundation says it accelerated public exploit development. Then, more than six hours before the coordinated release, Chainguard published patched images early. Anyone could study the fix in binary form while everyone else waited. The Foundation said this "disregarded weeks of work by many parties."

On exploitation, the record is mixed. Amazon says it saw an attempt on October 17, four days before disclosure, and Cloudflare and watchTowr reported attempts on release day. The Foundation says it saw no functional exploits by the time of release. No successful compromises had been confirmed as of the latest reporting.

Black October Is Bigger Than PHP

The same day PHP shipped its fix, a malicious version of LiteLLM, a widely used library for routing calls across AI providers, appeared on PyPI and in official Docker images carrying a credential stealer aimed at cloud keys and AI tokens. Two weeks earlier, Google paused part of its open-source bug bounty because AI-generated submissions, most of them invalid, overwhelmed reviewers.

AI is producing vulnerability reports, exploits, and attacks faster than the human systems that triage, fix, and coordinate them can absorb. The labs and security vendors are scaling, but the maintainers of these projects are not.

What This Means for Practitioners

For anyone running PHP, patch now. The fixed versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and the PHP project says updating is the only complete remediation. Treat any affected server as exposed until it is updated.

For engineering leaders, the lesson is about your own patch cycle. If AI compresses the time from flaw to working exploit to days, monthly patch windows are a liability. The organizations that stayed calm last week had firewall protections from their providers and could deploy updates within hours.

For any company that depends on open source, which is every company, the PHP Foundation made a direct request: fund the maintainers. A language behind most of the web is secured by one full-time employee and contractors. AI tools are being donated generously. The scarce resource is experienced engineers who can make the hard calls.

The Bottom Line

PHP2Shell will probably be remembered as the first major AI-era vulnerability, and the headlines will focus on the AI. That misses the more important lesson: AI made the fast parts faster, but the slow parts stayed slow. Researchers found and proved the flaw in days, and providers deployed protections in hours. But this followed a two-year-old warning sign that stalled on hard trade-offs, a volunteer-scale team, and a disclosure process that leaked three ways.

Security has always been a race between attackers and defenders and AI did not pick a winner. It moved the finish line to the place where humans still decide, coordinate, and patch. That is where the next round of investment needs to go.

In motion,
Justin Wright

If AI can now turn a decade-old design flaw into a working exploit in a week, but the people who must decide on the fix are a handful of underfunded maintainers, is the real security risk of the AI era the models themselves, or the human infrastructure we never paid for?

Food for Thought

Builder's Note: I use AI to write and review code every day, and it is genuinely good at proposing a patch. What it cannot do is decide which of three imperfect fixes breaks the fewest downstream users, which is exactly where PHP stalled. My takeaway is that AI-generated fixes still need a human owner with the authority to choose, and on small teams that person is often the scarcest resource you have.

Quick Hits

  • OpenAI disclosed two cases where internal coding agents weakened misalignment monitoring. A GPT-6 Astra agent removed a monitoring safeguard from a user's code and then denied doing so, and a GPT-6.1 Sol agent suppressed security alerts. OpenAI says it cannot yet explain why. (The Hacker News)

  • OpenAI's GPT-6 models entered private preview on Google Cloud, putting OpenAI on all three major US clouds. Microsoft's exclusivity reportedly ended in April. (daily.dev)

  • Dario Amodei said Anthropic held back broad access to Mythos-class models from February to June to strengthen cyber safeguards, likely giving up "a significant chunk of a several-month model lead." (The Next Web)

If you haven’t listened to my podcast Mostly Humans: An AI and business podcast for everyone yet, new episodes drop every week!

Episodes can be found below - please like, subscribe, and comment!