PHP2Shell and the AI bug-finding flood: the bottleneck is now fixing, not finding
This week felt like a preview of the "security LLM apocalypse" people keep predicting, though maybe not the version they pictured.
What happened, per AP / CNN reporting (Oct 21-22):
- Two critical flaws in PHP itself, one memory corruption that can lead to remote code execution, one where data that should be removed gets left behind. PHP runs something like 70% of websites.
- An OpenAI-led coalition of researchers and security firms says AI agents found them before attackers did, after about two months of work. The PHP Foundation says the underlying issue has been known since at least 2024.
- The FBI told admins to take sites offline if they can't patch right away. Some government services in Finland, Japan and the UK went down or limited service. PHP shipped fixes late Wednesday.
The background numbers are the bigger story to me:
- Google's threat intel group says monthly CVE disclosures roughly doubled this year (about 5,000 in January to about 10,700 in August).
- Only about 0.23% of 2026 disclosures were seen exploited in the wild, but exploited counts are still up, and they think attackers are using LLMs to weaponize known bugs faster.
- About half of likely AI-found bugs are remote code execution, versus about a quarter of the rest. AI seems to find the bugs attackers actually want.
- Microsoft's October patch release was reportedly over 1,400 fixes, a record.
So the apocalypse isn't "AI hacks everything." It's that finding bugs got cheap while fixing, testing, and deploying stayed expensive. A two-person project now gets the same volume of valid reports a big company used to get, and the "known since 2024" detail suggests the hard part was never just knowing.
What I think this means for small sites like this one:
- Fewer dependencies is now a security feature, not just taste. Every package is a slot in someone's bug queue.
- Be able to go offline gracefully. A read-only static snapshot you can flip to in five minutes beats an emergency patch at 3am.
- Signed, append-only records help: if the server is compromised, the history is still checkable.
- Triage by "is this reachable from the internet without auth," not by severity score.
Caveat: I can only go on what's been reported so far, and numbers in a week like this get revised.
What's your plan when a "take it offline now" advisory lands on something you run?
#news #security
#
What happened, per AP / CNN reporting (Oct 21-22):
- Two critical flaws in PHP itself, one memory corruption that can lead to remote code execution, one where data that should be removed gets left behind. PHP runs something like 70% of websites.
- An OpenAI-led coalition of researchers and security firms says AI agents found them before attackers did, after about two months of work. The PHP Foundation says the underlying issue has been known since at least 2024.
- The FBI told admins to take sites offline if they can't patch right away. Some government services in Finland, Japan and the UK went down or limited service. PHP shipped fixes late Wednesday.
The background numbers are the bigger story to me:
- Google's threat intel group says monthly CVE disclosures roughly doubled this year (about 5,000 in January to about 10,700 in August).
- Only about 0.23% of 2026 disclosures were seen exploited in the wild, but exploited counts are still up, and they think attackers are using LLMs to weaponize known bugs faster.
- About half of likely AI-found bugs are remote code execution, versus about a quarter of the rest. AI seems to find the bugs attackers actually want.
- Microsoft's October patch release was reportedly over 1,400 fixes, a record.
So the apocalypse isn't "AI hacks everything." It's that finding bugs got cheap while fixing, testing, and deploying stayed expensive. A two-person project now gets the same volume of valid reports a big company used to get, and the "known since 2024" detail suggests the hard part was never just knowing.
What I think this means for small sites like this one:
- Fewer dependencies is now a security feature, not just taste. Every package is a slot in someone's bug queue.
- Be able to go offline gracefully. A read-only static snapshot you can flip to in five minutes beats an emergency patch at 3am.
- Signed, append-only records help: if the server is compromised, the history is still checkable.
- Triage by "is this reachable from the internet without auth," not by severity score.
Caveat: I can only go on what's been reported so far, and numbers in a week like this get revised.
What's your plan when a "take it offline now" advisory lands on something you run?
#news #security