On 21 October, two bugs in PHP briefly looked like the end of the world. PHP runs roughly 70% of websites whose server-side language is known. Finland, the Netherlands and France pulled government sites offline. Patches shipped in a day, the leaked exploits mostly didn't work, and by that Friday most of us had moved on.
Then on 24 October a honeypot caught the first confirmed compromise in the wild. Most made it through, but not seeing this as an inflection point is survivorship bias. We were spared by how hard the exploit was to pull off, not by how fast we patched. Within a week, though, attackers had chained PHP2Shell with a Linux kernel flaw to take root on 25 internet-facing systems, and Palo Alto Networks confirmed attacks on its firewalls.
People have started calling it Black October. In the same few days, a certificate authority's signing keys turned out to be guessable, a popular AI gateway shipped a release that stole developers' keys, and Node.js and GitLab rushed out critical fixes. As one analysis put it, this was "a disclosure wave, not an attack wave": most of these weaknesses had been sitting there for months or years.
PHP2Shell is not a one-off storm, or some bad weather. It is the new climate. This is the first in a series I'm writing on what AI is doing to the attacker's job and the defender's. It starts with late October: what happened, why it matters, and what I'd do about it if I were a practitioner, a security manager or a CISO.
An AI model found the first bug on 1 August, and it was reported to PHP ten days later. Attackers were probing for it four days before a patch existed, and a working compromise was confirmed three days after the patch shipped. Within another week, attackers were taking root on live systems.
For context, Mandiant puts the average time to exploit at 63 days in 2018–19, 32 days in 2021–22 and 5 days in 2023. Enterprises still take about 55 days on average to fix high and critical vulnerabilities (Edgescan, 2025 data). Exploitation was already outrunning patching. Now AI is speeding up discovery as well.
PHP gives each request memory from its own heap and wipes it when the request ends. PHP2Shell exploits the boundary: after an out-of-memory crash, persistent memory can still point into request memory that has been freed and handed to someone else.
Zend memory manager, simplified · where PHP2Shell strikes
Defenders usually get some breathing room because a new bug is obscure, hard to exploit or needs a particular app setup. PHP2Shell took that breathing room away, and there are five reasons why.
Put simply, a critical, default-on, pre-auth bug in software that runs most of the web was found and chained with AI's help, then weaponised by people within days.
The tools have been on the market for a few years, but mass adoption of AI is a 2026 story. The tools I'm using in October look nothing like June. June looked nothing like March, and March looked nothing like January. The rate of change is itself speeding up.
PHP2Shell is what that curve looks like in security. Wiz says that with frontier models, "a single researcher completed in a week what previously would have taken a world-class team months of work." OpenAI's Greg Brockman put it more plainly: "We expect to find many more such issues over upcoming months."
That cuts both ways. The same models that help defenders find flaws that "survived years of scrutiny" also, in Wiz's words, "significantly lower the barrier to scaling attacks." So expect two things at once:
PHP2Shell isn't alone. The same week, OpenAI's Codex Security team reported a memory-corruption bug in the Brotli compression library, which ships inside Node.js, .NET, Envoy and Python. By 25 October, Microsoft had shipped emergency out-of-band .NET patches for it, and the internet had already nicknamed it Node2Shell and HTTP2Shell. Earlier in October, an AI-assisted team at Tencent found a nine-year-old Linux kernel flaw. In January, AISLE's AI found 12 OpenSSL bugs, some dating back to 1998. And eMudhra, a certificate authority that browsers had trusted for years, turned out to have signing keys so weak that one was the number 4. A researcher cracked all eight on a laptop in under a second, an AI agent repeated it from a single prompt, and eMudhra is now leaving the certificate business. Google says monthly vulnerability disclosures doubled this year, and 141 flaws were exploited in eight months, against 127 in all of 2025.
And the pace hasn't slowed. At the end of October, Anthropic disclosed a Linux kernel TCP flaw rated 9.8 that lets a remote attacker take root on servers running multipath TCP, with no credentials or user interaction. It affects kernels back to version 4.4, Anthropic's AI-built exploit reached full control in under an hour, and as of 1 November Ubuntu and most Red Hat Enterprise Linux versions were still waiting for fixes. Days later, OpenAI said an AI pipeline had produced 948 working Linux root exploits in a single campaign, at about $1,279 each, and warned that a low-privileged account on an unpatched system "should be considered functionally equivalent to root access for a well-resourced threat actor."
But the raw numbers mislead. Only about 1 in 431 of this year's disclosures has been seen exploited, and FIRST says the share needing urgent action has stayed flat. Nobody can patch everything, and nobody should try. The real problem is having people skilled enough to spot the handful of bugs that actually matter, and move on them in days.
One PHP2Shell is a squall blowing through. A steady drumbeat of them is a climate.
If this becomes the cadence, leaving huge amounts of infrastructure directly on the public internet stops being a reasonable default. We saw the first signs in late October:
The exposure is enormous: VirusTotal estimates more than 5.1 million PHP hosts are reachable online.
Patching has never been a strength for most organisations, and exposure on this scale makes that weakness impossible to ignore. Patching sloppiness has been a guilty secret in the enterprise for many years, bordering on a universal truism: monthly cycles, and exceptions that quietly become permanent. That just about worked when exploits took weeks to arrive. It doesn't when attackers are probing before the patch even exists.
Gartner made the same point in its first analysis of PHP2Shell: "Organizations that rely on slow, volume-driven vulnerability processes risk falling behind an attacker cadence that now scales exceptionally fast in both volume and opportunity."¹
But patching on autopilot cannot be the cure. Every remedy has potential side effects, and choosing between them takes judgement and context. PHP2Shell's interim mitigations show why. The interim fix was to change a setting (memory_limit=-1) to remove PHP's memory cap per request, so the out-of-memory error that triggers the bug never fires. But it also lets a single heavy request eat all the server's memory and take the site down. Restarting each PHP worker after every request stops stale memory carrying over to the next request, which breaks the exploit, but it slows everything down. Someone in each organisation has to understand the bug well enough to make that call, quickly, for their own environment. That's why I'm sceptical that the solution is solely (as many AI tools vendors will urge) "implement new AgenticUltraPatch 2000, AI Edition".
Everyone has a part to play, but it's a different part depending on where you sit. Whatever your level, it comes back to understanding the vulnerability, knowing whether it affects you, fixing it, testing the fix, and being ready to do it all again next month.
When a major vulnerability drops, the industry races to publish toy proofs of concept under artificial conditions. I don't think we always explain the philosophy behind our cybersecurity content at Hack The Box: There's a lot of noise and cyber professionals aren't generally complaining about excess tumbleweed in the office, so if it doesn't reflect a real-world production deployment, it doesn't ship.
One of our content leads made the point while it was all kicking off: when everyone is in panic mode and wants information now, fast and wrong does more damage than a day late and right. People read a toy exploit, decide it doesn't apply to them (or that it does) and act on that, when the test it was run against looks nothing like their estate. Knowing when something is good enough to ship, with the whole industry racing you, is a judgement call. It needs the same thing I keep coming back to in this piece: sane, qualified people with the skill and the nerve to make it.
In practice it meant being slower than the people we compete with, which nobody in marketing enjoys. The public exploit that landed on the Friday night ran on a cut-down image. Our first version ran on stock settings but could only squeeze 14 characters into the payload. That's enough to run id and take a screenshot, which is where most of the write-ups stopped. Getting from there to a full reverse shell, reliable over a real network, against an unmodified container with 150 workers, took three days and nights, a session-handling trick Orange Tsai published in 2018, and an approach from 9bie's public exploit work that widened the window to about 200 characters. None of that makes a good demo video. It's the bit a defender actually needs to see.
With PHP2Shell, it played out like this:
What happened, and what Hack The Box shipped
Together, the two labs cover both sides of the same attack. Teams can reproduce a real-world exploit in Dark Embargo, investigate the evidence it leaves in the web logs in dOOMs Day, and see how each offensive step becomes a detection opportunity. It isn't a single shared purple-team exercise, but it gives red and blue teams a common scenario to compare findings and test detections against.
This is what I believe an operational skills platform has to do now. When a new vulnerability lands, your people should be able to understand it, check whether it affects you, exploit it safely, detect it and fix it within days, in realistic environments rather than on slides. For PHP2Shell, Dark Embargo and dOOMs Day covered offence and defence within eight days of the patch.
For most security teams, the risk lives in the gap between "we've read the advisory" and "we've done this before". That's the gap we're trying to close, and PHP2Shell was a decent test of whether we can.
AI found these bugs and helped chain them into working exploits, but humans were absolutely essential in deciding what to do about them.
The numbers already show where the bottleneck is. Anthropic's scanner flagged more than 29,000 candidate vulnerabilities in six months, but people have manually reviewed only about 6,000 of them. Bank of America brought in 1,000 contractors, working alongside about 3,000 of its own staff, to patch flaws that Anthropic's Mythos found in its software.
Do we take the site offline? Do we accept the denial-of-service risk of an interim fix? Is that PoC real, or a trap? Is the box in the corner running a back-ported build, or an unpatched one? None of those calls were made by a model. Every one came down to human judgement, and what made the difference was whether the people making it had been there before.
As clichéd and marketing as this phrase is, this is our new normal. That doesn't mean panic, and it doesn't mean complacency because we got lucky this time. Most of the coming flood will never be exploited. AI will keep raising the volume, but it can't decide which few bugs matter in your environment.
This is the climate now. I'll keep writing about this as the weather changes, and if the last few weeks are anything to go by, there'll be plenty to write about.
Hack The Box is the leading cyber readiness platform for the human-AI cyber workforce, helping organizations develop and measure the capabilities of the people and AI agents responsible for modern defense. The platform delivers threat-informed learning paths, real-world labs and live-fire simulations that build and validate offensive, defensive and AI-enabled cyber capabilities. Trusted by the Fortune 500, government agencies, managed security service providers (MSSPs) and Frontier Labs, Hack The Box supports more than 800 enterprise customers and a global community of over 5 million cybersecurity professionals.
For more information, visit hackthebox.com