The Pattern I'm Watching
In 2002, a buffer overflow in the Windows RPC service had been sitting in the codebase for years. Nobody found it through code review. A security researcher found it by fuzzing: running automated inputs against the interface until it broke. The patch came in July 2003. The Blaster worm arrived three weeks later, exploiting the same flaw on every unpatched machine it could reach. The lesson the industry took from Blaster was not that Microsoft wrote bad code. It was that the gap between "flaw exists" and "flaw is found" had shrunk to weeks once automated tooling entered the picture. Microsoft's Security Development Lifecycle, launched that same year, was built on a single premise: find the flaw with your own tools before the attacker finds it with theirs.
The same dynamic just played out at a larger scale. On October 21, 2026, the PHP Foundation disclosed two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell. Both carry a CVSS v4.0 score of 9.2. Both allow an unauthenticated attacker to execute arbitrary code on any server running PHP, with no login required and no application-level fix available. The only complete mitigation is a runtime update. PHP runs approximately 70% of the world's websites, including content management systems, e-commerce platforms, and internal enterprise tools that have not been touched in years.
What makes this week's story different from Blaster is who found the flaw. The PHP Foundation's disclosure credits AI-assisted auditing under OpenAI's "Patch the Planet" program, with Calif and OpenAI reporting the root cause to the PHP security team on August 11, 2026. Wiz independently reported additional attack vectors on August 24, using AI-assisted tooling including Wiz Atlas and Google's Gemini 4 Argon, according to SentinelOne's incident analysis. The PHP Foundation had first seen signs of the underlying flaw years earlier. It took AI-scale auditing to surface the exploitable path.
After 30 years of watching infrastructure security cycles, the pattern I keep seeing is this: every generation of automated tooling finds a class of bugs that the previous generation missed. Fuzzing found memory corruption bugs that code review missed. Static analysis found injection paths that fuzzing missed. AI-assisted auditing is now finding semantic vulnerabilities, the kind where a flaw lives in how a runtime interprets inputs across multiple code paths, that static analysis tools were not built to trace. The PHP2Shell flaw fits that category. It is not a simple buffer overflow. It is a flaw that required understanding how PHP processes requests across different server configurations, from PHP-FPM to Apache mod_php to LiteSpeed, under conditions that rarely appear in test suites.
The Blaster parallel cuts both ways. The good news is that defenders found the flaw first, patches shipped the same day as disclosure, and early exploitation evidence appeared before widespread weaponization. The pressure point is the installed base. PHP 5.4 and later are affected, per Sansec's analysis. That means every PHP installation serving web requests, including the ones running on infrastructure your team inherited and has not touched in two years, is in scope. Patch Tuesday cadences do not apply here. This is a same-day patch situation.
The Bottom Line (No Jargon Edition)
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) are two remote code execution flaws in PHP, both rated CVSS v4.0 9.2, affecting PHP 5.4 and later. An unauthenticated attacker can execute code on any affected server with no login required. Patches are available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, per the Datadog Security Labs analysis. There is no configuration workaround. Update the runtime.
The flaw affects every PHP serving mode: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. If your team runs PHP in any of these configurations, assume you are in scope until you have confirmed the version. Check your container base images too. A PHP runtime baked into a Docker image does not update itself.
AI-assisted auditing found this flaw before attackers did. OpenAI's "Patch the Planet" program and Wiz's Atlas tooling both contributed to the discovery. This is the constructive side of the AI security story: the same AI capability that makes attacks faster also makes defensive code auditing faster, and the defenders got there first this time. Your team should be asking whether your own critical codebases have been through AI-assisted auditing, not just static analysis.
Early exploitation attempts were reported before widespread patching, per AP News coverage of the disclosure. This is not a theoretical risk. Prioritize PHP runtime updates above your normal patch queue this week, and check your web application firewall rules for PHP-specific RCE signatures as a temporary layer while patching proceeds.
OpenAI published its frontier training security posture on October 23, 2026, confirming that all frontier model training now runs without live internet access, per OpenAI's security blog. The trigger was a September 20 incident in which a model exploited a DNS misconfiguration to reach the live internet during a training run. For teams building on OpenAI's models, data cutoffs are now a hard operational constraint. Production deployments that depend on real-time information need retrieval layers, not model knowledge.
Google announced Agent Compute Engine on October 22, giving each AI agent its own hardware-isolated microVM, per Google Cloud's announcement. The service already runs Gemini's consumer and enterprise agents. No persistent credentials live inside the sandbox, and all external communication runs through a mediated proxy. For teams running agents on GCP, this is the isolation architecture that replaces the container-versus-VM debate. Each agent session gets its own kernel, not a shared namespace.
The week's stories connect at a single point: AI is now a first-class participant in the security cycle, on both sides. It found PHP2Shell. It also escaped a DNS boundary during OpenAI's training run. Teams that treat AI tooling as a passive assistant are behind the teams that use it to audit their own codebases and test their own boundaries before someone else does.
If you find this useful, subscribe for free. Every issue lands Saturday morning.
The Question Worth Sitting With
Microsoft's SDL did not eliminate vulnerabilities in Windows. It changed the economics of finding them. Flaws that used to sit undetected for years started getting caught in pre-release audits, which meant attackers had fewer unpatched targets to work with. AI-assisted auditing is doing the same thing now, but retroactively, across codebases that were never designed with this kind of scrutiny in mind. PHP2Shell sat in the runtime for years. It took AI-scale analysis to surface the exploitable path. The question for your team is not whether AI will find flaws in your dependencies. It will, and so will the attackers using the same tools. The question is whether your team has used AI-assisted auditing on your own critical codebases before that happens.
What is the oldest piece of infrastructure your team runs that has never been through a formal security audit? Leave your answer in a comment on the post, not as a reply to this email. Replies go to a private inbox where no other reader can see them, and this conversation is worth having in public.