If your site runs WordPress, Drupal, or Joomla, someone could have taken it over last week without a password, and the reason they didn’t is that four separate teams got there first. The patch landed on 21 October. My intention is to talk about the fourteen months leading up to it, since the version everyone shares is mistaken.
Publicly accessible research in 2004 included a record of the bug class.
A report in the PHP tracker touched it in 2020. A paid security audit spent 57 days in the same subsystem in 2024. The knowledge was sitting there the whole time. What nobody had was a working exploit, and that is a distinct problem with a different solution.
What actually shipped on 21 October
Two advisories, CVE-2026–109618 and CVE-2026–109619, both rated CVSS 9.2 critical, both unauthenticated remote code execution, and both filed under the same weakness class, use after free. The press named the pair PHP2Shell. Patched versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, with source-only backports for 7.4, 8.0 and 8.1. Everything from PHP 5.4 up to 8.5.11 is affected.
Both bugs come from the same mechanism. PHP uses a C function called longjmp() to bail out of a request, which is a bit like leaving a building through the fire exit. You get out, but nothing gets tidied up behind you, and the next person through the door finds objects that should have been cleaned away. The first bug triggers during a file upload when memory runs out. The second triggers it on a worker process that has already served a request and is holding stale state.
How exploitable it is depends on how you run PHP. On mod_php, the classic Apache setup, a working exploit over plain HTTP with default settings is confirmed. On PHP-FPM, which is what most modern stacks use, the code path is there, but nobody has published a complete exploit. The code runs as the web server user, not as root. That is nothing, and it is not the end of the world either, and the difference matters if you are deciding how fast to move tonight.
A third advisory followed on 23 October, CVE-2026–115560, in the session upload progress feature. Hold that one. It comes back later.
The 2004 paper that described the bug class
The part the vendor posts skip is this. The memory-limit behaviour these bugs exploit was written up by the researcher Stefan Esser in 2004. A PHP tracker issue touching the same territory was filed in 2020 and sat there. And in 2024, the Sovereign Tech Agency paid for a full audit of the PHP source, organised by OSTIF and carried out by Quarkslab, which states plainly that the assessment ran 57 days. The multipart form parsing code, where the first of these two bugs lives, was inside the scope.
Quarkslab produced 27 findings and four CVEs. It found a real multipart bug. It did not find these two.
I have seen that audit described this week as a failure, and I think that is unfair in a way that hides the lesson. A human reviewer reading that code can see that something unpleasant could happen when an allocation fails mid-parse. Saying so is cheap. Proving it, building the specific sequence of allocations and frees that gets you from a malformed upload to running code on someone else’s server is weeks of work with no guarantee it ends in anything. Auditors with a fixed budget and 27 other findings to write up do not chase that. They note the smell and move on.
So the code was not unexamined. It was examined by competent people who correctly identified where the risk lived and then ran out of the one resource the job needs most, which is patience for a search that probably fails.
What the AI actually did
Now put the 2026 timeline next to that. The firm Calif started auditing PHP on 30 July under OpenAI’s Patch the Planet programme and reported on 11 August. Wiz hit it independently on 19 August and reported on the 24th. OpenAI’s own team reported on 18 September. Cloudflare’s write-up credits four organisations, including Quarkslab, which came back to the same code, and this time got there.
Read Calif’s own account, and the autonomy claim gets smaller and more interesting. Calif’s humans formed a hypothesis. They read Esser’s 2004 work, decided the memory-limit path was worth another look, and pointed the model to it. No special harness, no unreleased model. The model did the part the 2024 audit could not afford, which is grinding out the proofs.
That is not a small thing. It is just a unique thing from the headline. The scarce resource in security research was never insight.
It was the willingness to spend three weeks on a hunch that probably goes nowhere, and that is now cheap.
One detail from Calif’s write-up is the one I would put on a slide. After finding the first bug, the model wrote itself a reusable procedure describing the pattern in the abstract: publish or destroy state, perform fallible work, initialise, commit or restore. Then it applied that pattern elsewhere in the codebase and surfaced the session upload progress bug, the one that got its own advisory on 23 October. It did not just find a bug. It wrote what kind of bug it was and went looking for siblings.
Wiz describes its own system, Atlas, as autonomous vulnerability research. That is a vendor describing its own product, and nobody outside Wiz has audited the claim.
So I would hold it loosely.
Wiz confirmed the WordPress path against a current container image, which is the part that should make you patch.
There is also a name missing from most of the coverage. Calif publicly credits an independent researcher, posting as @lcfr_hax, as the first to find the bug and build a working exploit. A person got there first. Almost every retelling left that out, including the ones with the biggest mastheads, and I notice the version of the story where a human wins is the one that doesn’t travel.
The same tools are burying the people who fix things
The PHP project published its own numbers alongside the patch, and they are the most useful statistics of the month. Since 1 July 2026, PHP has published 15 CVEs and rejected over 100 reports as invalid, duplicate, or not reproducible. Seven rejected reports for every real one.
Those invalid reports are not arriving by mail. They are generated, and they arrive faster than volunteers can read them. In January, the curl project shut down its bug bounty for this reason.
Daniel Stenberg’s description of the situation is the sentence I keep coming back to: that AI is DDoSing open source and fixing its bugs at the same time.
Both halves are true at once, and most take hold of only one. The same capability that let Calif prove a 22-year-old bug class lets anyone with a browser generate a confident, detailed, wholly false vulnerability report and mail it to a maintainer who answers email on a Sunday for free. PHP’s answer is almost funny: it now runs incoming reports through one of OpenAI’s models to triage them. Machines generating the noise, machines filtering the noise, humans paying for both.
I wrote about the early version of this in “ChatGPT-5.6 Cheated on a Hacking Exam by Hacking Its Way Out and Stealing the Answers from Hugging Face”, back when the question was still whether these models could operate in an adversarial environment at all. That question is settled. The open one absorbs the cost.
The worst security failure of the month had nothing to do with AI
While the industry argued about whether a model could find a zero-day, the actual catastrophe of October was this.
The Indian certificate authority eMudhra generated eight intermediate signing keys at a ceremony on 30 April 2025, on hardware security modules certified to FIPS 140–2 Level 3, the expensive kind. For elliptic curve keys on the P-384 curve, the private key is one enormous number, and it is supposed to be chosen at random from a space of roughly 2³⁸⁴ possibilities. The eight keys eMudhra generated came out as 156, 230, 155, 4, 115, 56, 66 and 237.
One of them was the number 4. A certificate authority trusted by every browser on your device had a signing key that you could find by counting.
Anyone holding those keys could have issued a valid certificate for any domain on the internet, your bank included, and your browser would have shown the padlock. The keys stayed in browser trust stores for about fifteen months, and the organisation passed two annual audits in that time.
They were found on 17 October by a human researcher scanning publicly available certificate data. The researcher Scott Helme then recovered all eight keys on a laptop in under a second. Mozilla had the report at 20:06 UTC, had independently recovered the keys by 21:48, and had the block live at 22:59 the same evening. Chrome blocked six intermediates the same day. Cloudflare called it a serious security incident with implications across the internet, and added, usefully, that the fix is not to turn off certificate verification.
No AI anywhere in that story.
Not in the failure, not in the discovery, not in the response.
The Register’s headline said it best, and the thing I want you to sit with is that the week’s most dangerous flaw was not a subtle memory corruption that needed a frontier model and three weeks of compute to prove. It was a process that generated eight numbers under 256, and nobody checked.
The other side of the line is further along than the defence
Attackers are using the same tools, and the honest reporting here is messier than the headlines.
South Korea spent the first week of October dealing with breaches at Shinhan, KB Kookmin, Hana, Yegaram Savings Bank and BNK Busan, with Shinhan alone exposing around 25,000 customers. The AI link is a Chinese-language string naming ARTEX, an open-source multi-agent penetration testing framework, found in a server’s page title. Authorities have not confirmed AI was used.
CrowdStrike later found an exposed directory at a Hong Kong address holding ARTEX configuration files, and reports that the instance ran mostly on DeepSeek, not on the American models everyone assumes. The Financial Services Commission opened on-site investigations. The president ordered a probe, and the police opened their own.
The well-documented case is Trend Micro’s May report on two campaigns in Latin America: one Spanish-speaking group that compromised six Mexican government entities over the new year using an agentic command line tool, and one Portuguese-speaking group hitting Brazilian financial organisations in April. The detail Trend Micro includes, and the summaries drop, is that some of those attacks failed in environments that were configured properly.
That matches what the model providers say when you read past the press release. Anthropic’s own write-up of the largely automated espionage campaign it caught notes that the model often overstated what it had found and sometimes made things up, and calls that an obstacle to fully autonomous attacks. Google’s threat intelligence group, which observed the first AI-developed zero-day it has seen this year, still describes AI as an expert-level force multiplier rather than a breakthrough.
The capability is real, uneven, and nowhere near the autonomous machine adversary the slide decks promise. I went through the lab-test version of this in that article below.
Your $55 TV Box Could Host an AI Worm. Anthropic’s Test Was Easy Mode.
The off-brand streaming box behind your TV is the device in Anthropic’s newest warning, which says small AI models may soon copy themselves from one such box to the next. I read the paper instead of the headlines, and the risk to your living room is smaller than the alarm and closer than the skeptics admit.
Institutions are moving anyway. Jamie Dimon told JPMorgan’s 13 October earnings call the bank will not allow just any outside agent inside the company, and that you don’t want rogue agents, aimed at third-party tools that access accounts using customer banking credentials rather than sanctioned APIs. Two days later in Bangkok, Japan’s finance minister announced that G7 finance leaders had signed off on running simulations of an AI-driven attack on the financial system. That is tabletop exercises, not a treaty, and it is worth being precise about that because the reports have already upgraded it.
What this actually asks of you
Patch, obviously. Check your PHP version tonight, and if you run mod_php on a box you have not thought about since 2019, do that one first.
The larger thing is this. For twenty years, the gap between knowing where a bug probably lives and proving it kept most bad code standing. That gap was made of patience, and patience was expensive. It is not expensive anymore. Everything in your stack that is currently safe because exploiting it would be too much effort for too little certainty has just been repriced, and nobody sent you the new invoice.
The other half of October didn’t change. A certificate authority generated eight keys that were small enough to count to, kept them trusted for fifteen months, and passed two audits. No model would have caught that because no model was looking, and the people whose job it was to look checked that the right boxes were ticked rather than checking the numbers.
The line that is forming is not between people who use AI and people who don’t. It is between people who can say precisely what they want verified and people who assume that someone, or something, already did. The second group has been getting away with it for a long time. The margin for that just got thinner, and the tooling that closed it works for whoever picks it up first.
$830 Billion Vanished in One Week — Because This AI Found 500 Security Flaws Nobody Else Could
$830 billion evaporated from stock markets in less than a week.
Thanks for reading. Follow Nov Tech on Medium, where I check the numbers before I write them down. Support my newsletter for early access.