On Wednesday the PHP project shipped emergency fixes for two flaws, CVE-2026-109618 and CVE-2026-109619, that together let a stranger run code on a web server without logging in. PHP sits under roughly 70% of the world’s websites, so within days there were millions of exploit attempts, and Finland’s government and the Office for Budget Responsibility were among those pulling sites offline rather than wait. This blog is static files on S3, so I watched from the sidelines and felt slightly guilty about how relieved that made me.

The bug had been in PHP for fourteen years, and a limited version turned up in 2024 without anyone thinking it mattered. This time Calif found it with GPT-5.6 Sol, under OpenAI’s Patch the Planet programme, while Wiz found both flaws on its own and had its agent, Atlas, working with Gemini and GPT models to chain them into a working exploit in about a week. OpenAI calls the gap before disclosure a “Defender’s Window”, but two teams with off-the-shelf models reaching the same flaw is reason to doubt they were alone, and Amazon’s honeypots logged an exploit attempt on 17 October, four days before the fixes went out.

The attacking side has the same tools. The same week, Reuters showed what a weaponised agent looks like when nobody’s watching it. A Chinese-speaking hacker gave AI agents fewer than 100 Chinese characters of instructions, pointed them at more than 1,200 sites and got into more than 100 companies, Deere among them, on roughly $5,000 of DeepSeek and Claude Code tokens. That works out at about $50 a break-in.

In April I wrote about a fifty-dollar zero-day as though it were still a lab result. Finding the bugs is cheap now, and so is running the break-ins; the fixing still happens one server at a time, by someone reading an advisory at midnight, which is the patch capacity problem with a stopwatch on it.

Sources: