This is part of WeGoAI's daily series on the things that actually shape our world. Figures from the PHP Foundation, Calif, Wiz, Censys, ANSSI, CERT-FR, the Cloud Security Alliance AI Safety Initiative whitepaper, Qualys, VulnCheck, Rapid7 and NIST. All news dated 20-23 October 2026. Not investment advice.
“This is part of WeGoAI's daily series on the things that actually shape our world.”
Four Days That Mattered
Between 17 and 21 October 2026, two critical flaws in PHP core - CVE-2026-109618 and CVE-2026-109619, both scored 9.2 on CVSS v4.0 - went from a secret inside an embargo programme to a global emergency. The PHP Foundation calls the pair "php2shell". PHP runs on roughly 70% of websites, so the blast radius was the internet's most common server-side runtime.
Here is the part that matters for anyone who runs software. The bug was found in days by an AI-assisted researcher. The exploit appeared four days before the patch. The patch itself took 81 days to arrive.
That is the whole story of 2026 security in three numbers.
AI Found It Fast
On 30 July 2026, Ryan Austin - a researcher at Calif who posts under the handle @lcfr_hax - joined OpenAI's "Patch the Planet" programme, which pays security teams to audit critical open source with model support. PHP was an obvious target. On 1 August he found the first bug. On 5 August he published the cryptographic hash of his finding on X, which dates the discovery without revealing it. On 11 August he reported it to PHP's security team.
Two other teams reached the same root cause independently. OpenAI, working in the same programme, reported on 11 August - the same day. On 24 August, Wiz's research team reported further attack vectors.
Wiz's own account: one researcher, AI-assisted, completed in a week the work that would have taken a team months.
There is a second, older thread. The PHP Foundation acknowledged that the first signs dated back to a 2024 audit funded by the Sovereign Tech Agency. A core developer glimpsed the corruption tied to running out of memory. No concrete vector existed, so the matter was postponed. It stayed postponed for two years.
81 Days From Finding to Fixing
Add up the calendar. 81 days from the day the bug was found to the day the patch shipped. Ten of those days to reach the PHP security team. Seventy days of embargo coordination. And then, four days before the patch was even published, the first exploit attempt had already been recorded.
Amazon's honeypot logged a first attempt on 17 October. The embargo broke on 20 October at 15:00 UTC, when an anonymous Hacker News post announced "2x PHP RCE CVEs with CVSS 10.0 Incoming" and admitted it had "no evidence beyond source: trust me, bro". watchTowr confirmed the flaws were real three hours later. At 19:00 UTC PHP brought the release forward by a day. At around 20:00 UTC, Calif accidentally published a demonstration video of its exploit chain. It was pulled within minutes and copied widely.
By 07:00 UTC on 21 October, Chainguard had published patched container images, breaking the embargo by six hours. At about the same time, the first attacks were reported by Patchstack and by Cloudflare's CTO. The patch landed at 14:00 UTC: versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with source backports for 7.4, 8.0 and 8.1.
Cloudflare's web application firewall rules went into blocking mode for all customers at 03:00 UTC - nine hours before publication, and free on every plan. That was the only thing standing between the internet and a patched weekend.
The Clock That Does Not Work
The Cloud Security Alliance's April 2026 whitepaper on the collapsing exploit window puts the trend in numbers. Mean time to exploit a disclosed CVE fell from about 32 days in 2022 to about 5 days in 2023. By the first half of 2025, 32.1% of newly tracked exploits were already live on or before the CVE's public disclosure date, up from 23.6% in 2024.
The defender side did not move. The April 2026 Qualys benchmark found the mean time to remediate complex enterprise applications at five months and ten days. Roughly 45% of enterprise vulnerabilities are still unpatched after twelve months. The CISA Known Exploited Vulnerabilities catalogue reached 1,484 entries in 2025, growing 20% in one year, and about 20.5% of those have been exploited by ransomware groups.
Put the two clocks next to each other. The attacker works in five days. The enterprise works in one hundred and sixty. A patch cycle measured in months has no useful relationship to an exploit window measured in hours.
1.5 Million Hosts, Still Exposed
Censys counted about 1.5 million of the 2.6 million internet-facing PHP hosts it examined still running an unpatched version shortly after the fix shipped. That is roughly 58% exposed, with the cure already available.
ANSSI gave a sense of one national estate: more than 600,000 servers on the French internet run PHP. On the afternoon of 21 October, at ANSSI's request, France's Interior Ministry placed all of its exposed sites into "preventive maintenance", prefectures included. Meteo-France closed its forecast and weather-warning sites. The tax authority's site showed a maintenance page. This was not an attack. It was a voluntary shutdown while the fix was applied.
The United Kingdom was told in the House of Lords that thirty-two government services were unavailable. Japan's Prime Minister asked for action "tonight". Canada, Australia, Belgium and Germany also took public sites down, as a precaution.
Two contradictory facts sat side by side the whole time. On one side the deluge: Cloudflare went from thousands of attempts to millions, with payloads mutating to bypass its own rules. On the other, the void: nobody confirmed a successful intrusion. Sophos announced a compromise at a customer, then retracted it a few hours later. Public exploit code crashed. The flaw never reached CISA's catalogue of actively exploited vulnerabilities.
Worth saying plainly: for once the defenders held. Cloudflare's pre-built rules, the coordinated 14:00 UTC release and the refusal to ship a worse patch all worked. The system is not broken. It is fast, and it nearly broke.
The Economics Changed
The reason this happened in 2026 and not in 2016 is cost. CSA's figures: AI systems now generate working proof-of-concept exploit code for published CVEs in 10 to 15 minutes, at roughly one dollar per attempt. The CVE-Genie multi-agent framework reproduced 51% of all CVEs published in 2024 and 2025, complete with verifiable exploits, at an average cost of $2.77 per CVE. A single agent swarm identified more than 100 exploitable kernel vulnerabilities across AMD, Intel, NVIDIA, Dell, Lenovo and IBM driver code over a 30-day run that cost $600 - about six dollars per flaw.
In a realistic Active Directory environment, one AI framework compromised four of five hosts for $28.50 total, against $15,000 to $50,000 for an equivalent human penetration test. That is a 156-fold cost reduction and 3,600 times faster.
The tool ecosystem grew to match. Before GPT-4 launched in April 2023, fewer than five open-source AI-assisted penetration testing tools were in widespread use. By March 2026 there were more than seventy. CyberStrikeAI, published to GitHub in November 2025, had run confirmed attacks against more than 600 devices across 55 countries by January 2026.
A professional now costs $28.50. A weekend costs $1. The economics of "wait for the patch" collapse when the wait costs more than the attack.
Why This Is Structural
One more piece of context makes the trend hard to dismiss. A record 48,185 CVEs were published in 2025, a 263% increase from 2020, and submissions in the first quarter of 2026 ran roughly a third higher than the same period in 2025. NIST responded in April 2026 by announcing it would triage NVD enrichment, prioritising KEV entries, federal software and critical infrastructure. That is an admission that it cannot enrich all of them.
There is a lag nobody budgets for either. The average gap between exploit publication and formal CVE assignment is 23 days. During that window, exploitation is already active and the record that would tell you so does not exist yet.
Confirmed exploitation of CVSS 7-10 vulnerabilities rose 105% year on year between 2024 and 2025, from 71 to 146 documented cases. Rapid7's reading is that threat actors are "weaponizing known, preventable conditions faster - not necessarily developing new attack sophistication". That is the correct read. Nothing clever happened. A patch did not get applied.
The PHP Foundation's own words were blunt about the cause: a structural failure. They have announced they are strengthening PHP's security organisation. The core problem was never the patch. It was the seventy days between the report and the fix, and the fact that the first sign of the bug sat in a 2024 audit with no concrete vector, waiting for someone with both the skill and the time to connect it to a working exploit.
What To Do Before The Next One
Read your PHP version per SAPI, not per host. The fix applies to 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Verify the version the web server actually runs. PHP supports each branch for four years - two years of active support, then two years of security fixes only - so an old branch means old code.
Expect a regression, then a second patch. The emergency fix touched nearly four hundred files and introduced a double-free of the SimpleXMLElement property table on 8.4.27 and 8.5.12. It is not a security flaw - it crashes legitimate code - and it ships in 8.5.13 and 8.4.28. Move to 8.5.13 when it lands.
Turn on the provider's firewall rules, but do not trust them alone. Application protection acts after the point of impact, filters known traffic shapes, and Cloudflare saw payloads mutate against its rules. It buys time. Only accept traffic from your provider's published addresses, or the attacker skips the proxy entirely.
Do not run scanners that send hostile traffic to production. Some public scanners probe the suspected path with edge-case multipart requests and count the PHP-FPM workers that die. Running them against production takes down a worker, and a "mitigated" result only means something upstream returned a 403 - not that PHP is fixed. Reading the version decides without sending anything dangerous.
Search, then rotate. If a host was exposed without a stopgap between 20 October and its update, look for recent files in the web root, new cron jobs, created accounts and added SSH keys. Then rotate every secret the server could reach. If an attacker got through, that is what they took.
Treat a firewall rule set as a stopgap with a shelf life. It expires. The next zero-day will not have a rule ready.
The Numbers To Remember
---
AI now finds the bug, writes the exploit, and costs less than the ticket to ask for a patch. The bottleneck moved from discovery to response, and response is still human. The window between the two is the number that matters.
