What researchers are talking about: AI-found bugs and the PHP2Shell fight

Our other posts this week cover what attackers did: the flaws they exploited and the ransomware claims. This one is about the people on the other side. We read the research blogs, write-ups, podcasts and forum threads security researchers published or argued about between 26 October and 5 November 2026, and picked out what kept coming up. Two subjects dominated: AI that finds and exploits bugs, and a fierce argument over whether the biggest bug of the month was as dangerous as the warnings said.

AI-found bugs are now on the exploited list

Until recently, AI bug-hunting was mostly a matter of benchmarks. This fortnight, three flaws that AI helped to find were on CISA's list of vulnerabilities attackers are using.

• PHP2Shell (CVE-2026-109618 and CVE-2026-109619), a way to run code on PHP servers that goes back to code from PHP 5.4, was found by the firms Calif and Wiz with OpenAI. Calif's write-up describes using a language model as an "audit buddy" that worked through a checklist of bug patterns, and Wiz called it an "AI inflection point" (Calif, Wiz).
• Brotli (CVE-2026-111497), the compression flaw that reaches Node.js, .NET and the Envoy proxy, was reported by OpenAI's Codex Security team. The fix was written in February but only released in October, because nobody had flagged it as a security fix (The Hacker News).
• WordPress (CVE-2026-119977), the race in the core updater: the researcher at Picus Security who reported it says he found it with an AI model in about four hours (Picus).

The AI labs published their own results in the same week. Anthropic said an unreleased model had found and chained flaws in Chrome, Safari, Android, Windows and Linux, including 62 Chrome CVEs and a remote root bug in the Linux network stack, CVE-2026-98432 (Anthropic); The Hacker News pointed out that the report does not say how much of each step was done by people (The Hacker News), and Akamai followed with an analysis of the Linux bug (Akamai). Google announced Gemini 4 Carbon, a model aimed at finding and fixing vulnerabilities and available at first only to vetted defenders; its benchmark results are Google's own (SecurityWeek).

The most useful piece for practitioners came from Google's Project Zero, which compared six months of results from its AI agent Big Sleep with those of Fuzzilli, the fuzzer it has run against Chrome's JavaScript engine for years. Big Sleep found 45 real bugs and Fuzzilli 37, but only 20 were found by both. The conclusion: the two find different things, so keep running the fuzzers (Project Zero). There is a cost on the receiving end too. The PHP project says that since July it has handled more than 100 invalid, duplicate or unreproducible reports, many of them AI-generated, alongside 15 real flaws (The PHP Foundation).

Hype or catastrophe? The PHP2Shell argument

PHP runs a large share of the web, so when details of PHP2Shell leaked on 20 October, a day before the fix, the warnings were stark. On 21 October many European public websites took themselves offline as a precaution, among them the Dutch NCSC, DigiD and MijnOverheid, the Dutch House of Representatives, French prefecture sites, German federal sites and Finnish and Belgian government services; UptimeRobot counted about 20 times the usual number of downtime alerts in Europe that day (UptimeRobot).

Two weeks on, the measured damage is much smaller than feared. Wiz says the number of exposed vulnerable machines it sees fell by about two thirds and that it saw no successful attacks in its own data (Wiz). GreyNoise counted at least six successful exploitations, and experts told The Record that real attacks need an exploit tuned to each server's exact build (The Record). Palo Alto's Unit 42 withdrew an early claim that a European government agency had been breached this way (The Hacker News). The confirmed break-ins were Palo Alto firewalls, where every device runs the same PHP build, so one tuned exploit works on all of them; even there, only about 240 of roughly 19,000 exposed devices ran a version the exploit could handle (Hunt.io). Kaspersky, citing Censys, says some 29 million of 46 million scannable PHP servers are still unpatched (Kaspersky).

That gap started the argument of the fortnight. In a widely shared post titled "I want my Wednesday back", developer Lucas Luitjes argued that recommending downtime for a bug this hard to exploit teaches people to ignore the next warning (blog.luitjes.it); the Hacker News thread about it ran to hundreds of comments (Hacker News), and the Risky Business podcast called PHP2Shell a flaw "that was hyped but seemingly didn't cause much damage" (Risky Business #857). Forrester took the other side: the real story is that AI discovery, AI-written exploits and leaked disclosures are arriving together, and the next one may be easier to exploit (Forrester). Both can be true. A flaw that is hard to exploit at scale is still being exploited against targets that are worth the effort, which is why it is on the exploited list.

Record volume, a weaker signal

Behind that argument sits a numbers problem. CIRCL in Luxembourg counted 17,097 new CVEs in October, a record for the third month running, and summed up its report as "the noise grew while the exploit signal shrank" (CIRCL Vulnerability-Lookup). CyberHire counts 769 CVE records crediting an AI system or lab, up from 34 a year earlier, while the share of new CVEs that get exploited fell from 0.45% to 0.25% (CyberHire). Dataminr argues the real problem is speed, not volume: the average time from disclosure to a flaw landing on CISA's exploited list has fallen from about 150 days to under 30 (Dataminr). "Where is the vulnpocalypse?" was also the title of a debate at [un]prompted, the AI security conference held in San Francisco from 27 to 29 October ([un]prompted). For defenders the practical lesson is the same as ever, only more pressing: you cannot patch 17,000 flaws a month, so let evidence of exploitation decide the order.

Embargoes are leaking

Researchers also spent the fortnight arguing about how flaws are disclosed, because the process failed in several places at once. The PHP2Shell details leaked before the fix: a post on Hacker News was deleted, but screenshots spread on X and Mastodon (Threat Landscape). On 21 and 22 October, Trend Micro's Zero Day Initiative sent six unpatched Linux kernel bugs, including two remote code execution flaws in the kernel's SMB server, to public mailing lists instead of only to the kernel security team (Slashdot, pwn.watch). CyberScoop reported that Ivanti found part of its Connect Secure flaw in June but judged it below its threshold for an urgent fix (CyberScoop). And the Brotli fix sat unreleased for eight months.

Getting fixes into the versions people actually run is the other bottleneck. Trail of Bits described using AI to backport fixes for 149 CVEs into stable Linux kernels, at about half an hour of human time each, and counted 2,006 unfixed CVEs in the 5.10 kernel branch alone (Trail of Bits). If you run long-term-support systems or appliances, ask your vendor how it keeps up.

Developer tools are the new target

Several of the fortnight's incidents hit the tools developers and AI teams use, not the products they build.

• LiteLLM, a widely used library for connecting applications to AI models, shipped malicious builds on PyPI, Docker Hub and GitHub's registry for about two hours on 21 October after an attacker got into its release pipeline. The bad images carry a valid signature, so check image digests, not just signatures (LiteLLM).
• A fake "Claude Code" extension, not built by Anthropic, sat in the Cursor editor's marketplace for about 11 hours on 29 October and installed an SSH key and a reverse tunnel on developers' machines (Cursor).
• The theft of more than $6 billion from Binance, which the FBI attributes to North Korea's TraderTraitor group, began, Binance says, with a fake job interview and a rigged coding assignment given to an engineer (BleepingComputer, Infosecurity Magazine). It led the Risky Business episode of 4 November (Risky Business #858).
• The GitLab flaw on CISA's list (CVE-2026-97229) is triggered from a CI/CD file, and Shadowserver data shows more than 2,000 vulnerable GitLab servers in Europe, about 1,100 of them in Germany (ITdaily).

Developer laptops, build pipelines and package registries hold the keys to everything else. Treat them as production systems.

Spyware and old phone bugs, close to home

Apple sent new threat notifications about "mercenary spyware" from 29 October, and they reached members of the German Bundestag; Germany's BSI told recipients to assume their phone was compromised, update it and consider Lockdown Mode or a new device (Security Affairs). Separately, Sekoia described websites in Ukraine, the Czech Republic and Bulgaria, and a hijacked analytics script, that served exploits for old iPhone and Android flaws; it attributes the campaign to APT29 (Sekoia). One of those Apple flaws, from 2024, is now on CISA's list, as we describe in our patch post.

Also worth reading

• Scalable Vector Grief: PortSwigger's Gareth Heyes bypassed six of eight popular SVG sanitisers; DOMPurify held (PortSwigger). A second PortSwigger post shows an AI agent turning a header injection into a working exploit on its own (PortSwigger).
• GoAhead: FoxIO found TLS flaws, including one scored 9.1 (CVE-2026-115881), in an embedded web server used in the management pages of what it says are hundreds of millions of devices. The upstream fix is in version 6.1.1, but each device maker has to ship it (SecurityWeek).
• Pwn2Own Ireland: 98 zero-days and $1,262,000 in prizes in Cork in early October, including a $300,000 chain against the Google Pixel 10 and a hack of OpenAI's Codex; nobody entered for the iPhone 17 (Zero Day Initiative). The technical write-ups are due after the usual 90 days, around January.

Coming up

• Objective by the Sea, the Apple security conference, has its talks from 18 to 20 November, streamed online (OBTS).
• Black Hat Europe runs at ExCeL London from 7 to 10 December, with the briefings on 9 and 10 December.

What it means for you

• Expect less time between a fix and an attack. AI is speeding up both finding bugs and turning them into exploits. Patch internet-facing systems in days, using our exploited list to set the order.
• Judge a scare by the evidence. PHP2Shell was real but narrow. Before taking services offline, check whether your exact versions are affected and whether exploitation has been seen; our CVE pages show both.
• Know what is inside your products. PHP, Brotli, GoAhead and the Linux kernel ship inside appliances from other vendors, often months behind. Ask suppliers how fast they ship upstream fixes.
• Protect the people who build your software. Check editor extensions, lock down CI/CD and package publishing, and be wary of job "assignments" that run code.

We link the write-ups, reports and discussions this article draws on. Figures from vendors and research firms are their own and have not been verified by Cyfenced; where sources gave different numbers we have used the more cautious one. Benchmark results reported by AI companies are their own claims.