TL;DR
The short version
AI found PHP2Shell before attackers did, and the world still had hours, not weeks, to patch. When AI can find internet-scale bugs, the time defenders have shrinks to almost nothing, and defence has to run on agents too.
On The AI Daily Brief, Nathaniel Whittemore walks through the week PHP shipped emergency fixes for two critical bugs, exploit attempts went from thousands to millions, and two AI developer platforms lost customer secrets. Read alongside the primary sources, it is a story about disclosure timing more than rogue AI.
Built on Nathaniel Whittemore's episode (23 October 2026). Figures checked against OpenAI, the PHP Foundation, NSA and TechCrunch.
AI found it first, and that bought two months
On 21 October 2026, PHP shipped emergency fixes for two bugs, together called PHP2Shell. Both let an attacker run code on a web server without logging in. PHP runs roughly 70% of websites, and the bugs reach back to PHP 5.4. Volker Dusch, a PHP Foundation security engineer, called it the most severe issue PHP has faced in more than a decade and compared it to Heartbleed.
The finding came out of an AI-assisted audit. Calif found the flaw using OpenAI's GPT-5.6 Sol, as part of OpenAI's Patch the Planet programme, and Wiz found both bugs independently. OpenAI says frontier AI found them before attackers did, "opening a Defender's Window."
That window was about two months of quiet work. Maintainers wrote fixes, distributors prepared packages, and Cloudflare built firewall rules. Calif is careful about the AI's share: most of the work relied on what its researchers already knew about PHP. "No model is simply capable of unearthing 'all bugs' with simple prompts," it wrote.
The window closed in hours
Then it leaked. Disclosure moved up a day. Chainguard published patched images more than six hours before the coordinated release, according to Dusch. Amazon says it saw exploitation about a week before the patches came out.
The bigger problem is structural. For open-source software, the patch is the map. As Nathaniel Whittemore explains, once the fix ships, anyone can read it and see where the hole is. AI makes turning a patch into an exploit faster still.
Cloudflare's Matthew Prince described the curve: thousands of exploit attempts in the 10 hours before the announcement, tens of thousands within 45 minutes after it, hundreds of thousands within two hours. Then millions.
OpenAI and Cloudflare's Matthew Prince, October 2026
So the advice was blunt. NSA told organisations that couldn't update right away to take systems offline. Government sites, banks and forums went dark while they patched.
It wasn't one bug
The same week, two AI developer platforms lost customer secrets. OpenCode had API keys stolen from a legacy console, and attackers used them to run up charges on users' AI accounts. Railway found an attacker had reached encrypted environment variables and decrypted some of them. Both told every user to rotate their keys.
OpenCode's Dax described what defending looks like now. Ethan Mollick put the shape of it in one line: attack and defence speeding up "at inhuman speeds, interacting with the very human systems that need to react to them."
They're not going to stop. It's going to get increasingly sophisticated, and they're going to go after every surface of your system and all of your employees. [...] The only reason we're surviving is because we have agents going 24/7.
Dax, OpenCode, as read on The AI Daily Brief
Defence has to run on agents
The defensive case is real. Entrepreneur John Ennis rotated every key across a large number of projects very quickly, which not long ago would have been a nightmare. His point: "you can't stop a nuclear weapon with another nuclear weapon, but you can stop an AI attack with an AI."
Box's Aaron Levie expects cyber to absorb far more tokens than anyone is planning for, with agents scanning every log and every line of code. He also expects more security jobs, not fewer, because someone has to point the agents at the right work and review what they find.
Others think scale decides who survives. Will Manidis argues banks and hospitals may have to merge to afford AI-era defence. In OpenAI's response framework, the company asks when governments should be allowed to scan the internet and patch vulnerable systems remotely.
Read the panic carefully
The loudest claims didn't hold up. Posts said agents were "hacking about half the internet" and that 70% of sites "may have already been compromised." As of 24 October, TechCrunch reported no mass exploitation; Palo Alto Networks and Trail of Bits had confirmed one compromise of an unnamed target. Coordination mostly worked, and the gap between patch and exploit stays open on unpatched servers.
Many of the voices are also selling something: security products, AI agents, or the labs' own defence programmes. Martin Casado's line is the fairest summary: in the long run AI will make software more secure, "but before that, things are going to get much, much worse."
