Why Exposure Management Has to Move at Machine Speed
A flaw hiding in PHP for over a decade, leaked before the patch was out. The researchers who found it say frontier AI models are what made exploitation practical.
That's PHP2Shell, disclosed on October 21, 2026. It's two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in the core PHP engine, the language behind roughly 70% of websites, including WordPress, Drupal, Joomla and the software that runs Wikipedia. Both flaws allow unauthenticated remote code execution, which means an attacker can take control of an affected server without ever logging in. The PHP team has released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and agencies including CISA and the UK's National Cyber Security Centre are urging organizations to patch immediately or take vulnerable systems offline.
But the real story isn't PHP.
What changed: AI collapsed the time to exploit
According to Wiz Research, one of the teams behind the discovery, the underlying flaws had been present for more than a decade. Turning them into a working exploit required a chain of steps so complex it sat at the edge of what human researchers could practically achieve. Frontier AI models lowered that barrier, helping researchers build and adapt working exploits in hours.
That's the shift every security leader should pay attention to. Complexity used to be a quiet layer of protection. It no longer is.
Why the vulnerability queue is breaking
Most security programs still run vulnerability management as a queue: scan, score, patch, repeat. That model assumed attackers needed weeks and specialized skill to weaponize a flaw. AI is removing both. The window between disclosure and exploitation is shrinking from weeks to hours.
And patching isn't always an option. Many older PHP versions still in use are no longer officially supported, and plenty of business-critical systems can't be taken down on short notice. For those systems, "are we patched?" has no useful answer.
The better question: what can an attacker reach?
The question for leaders is shifting from "are we patched?" to "what can an attacker reach from here, and how quickly can we cut that path?" That's the move from managing vulnerabilities to managing exposure, and it can't be done at human speed anymore.
How Electric Mind helps
Our Exposure Defense at Machine Speed service rebuilds vulnerability and exposure management for this new reality. It maps the attack path, decides where to break it, and puts compensating controls like AI-drafted WAF rules in place where patching isn't possible yet. A human validates every change. Live threat intelligence keeps triage current, so analysts spend their time on the exposures that need human judgment rather than on classification.
The result is triage in hours instead of weeks, with a clear record of every decision for auditors and regulators.
The bottom line
PHP2Shell won't be the last vulnerability that AI helps turn into a working exploit. The organizations that come through this era well will be the ones whose defenses move as fast as the attacks.
AI made offense faster. We're using it to make defense faster.
Want to see how your program would hold up against a PHP2Shell-class disclosure? Talk to our cybersecurity team.