From AI spam to PHP2Shell

On October 21, PHP shipped emergency fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which came to be known as PHP2Shell. They allowed an attacker, with no authentication at all, to execute code on the server. PHP runs about 75% of the websites whose programming language can be identified, and the oldest affected path goes back to PHP 5.4, from 2012. Government agencies in the Netherlands, Finland and Australia took websites offline as a precaution.

In simple terms, a specially crafted request makes PHP run out of memory, or hit a fatal error, in the middle of processing. When it cleans up that request, PHP uses memory that is no longer valid, and from there an attacker can get to code execution. What happens in practice is that a website on an unpatched version of PHP can be controlled remotely by an attacker, with no password whatsoever. From there, the attacker can read or change the data the website has access to and run their own programs on the server.

PHP2Shell is not an isolated case. Also on October 21, Node.js fixed Node2Shell, a flaw in Brotli, the decoder that handles compressed data, which could also allow code to be executed remotely. In May came news of an 18-year-old vulnerability in NGINX, the web server behind a third of the most visited websites, found by an autonomous AI system. In January, AISLE said it had found all 12 flaws in a round of fixes to OpenSSL, the library that protects a large share of connections on the internet, in code that in some cases goes back to 1998.

PHP2Shell was found with AI. The PHP Foundation recounts that Calif began auditing PHP on July 30 and reported the flaw on August 11, that OpenAI independently reported the same root cause, and that Wiz added further attack vectors on August 24. According to Calif, humans chose the target and supplied the theory, and it was an agent that read the code and pointed out the flaw.

From spam to discoveries

In 2024, AI promised to disrupt the way developers wrote code. The general opinion was that the internet would become filled with weak code, riddled with vulnerabilities.

In 2025, AI promised to find vulnerabilities at unprecedented scale. What happened was the creation of spam on an unmanageable scale, leading projects like curl to shut down their bug bounty in early 2026, such was the volume of noise.

In late 2026, AI keeps generating spam at scale, but within that spam there is such a substantial quantity of security vulnerabilities that nobody can get out of the work of filtering the spam to find the value in it. In April, curl's lead developer wrote that the challenge had "transitioned from an AI slop tsunami into more of a ... plain security report tsunami": "Many of them really good."

From January to October 2025, GitHub's security advisory database published about 3,000 reviewed vulnerabilities. In the same period of 2026 there were more than 12,000, and the critical ones, over the first nine months of the year, went from 281 to 1,221. In May, GitHub published more than 1,500, the highest in its history and more than five times the usual. In the public vulnerability registry, 48,150 were counted across all of 2025, and there are already more than 93,000 in 2026. These numbers don't say how much of this came from AI, but it is clear that these increases are due to the use of AI to discover vulnerabilities at greater scale.

Data: GitHub Advisory Database.

What we see at Immunefi confirms it. In 2023, no report made with ChatGPT contained anything real. It was all spam, and the use of AI was seen as something to ban. In 2026, the number of reports has risen significantly, and I can say that the overwhelming majority make use of AI, if not that almost 100% of the writing is done by AI. In August 2026, Immunefi recorded 424 valid reports, against 154 a year earlier, and confirmed critical bugs went from 14 to 126. Today we are a platform that welcomes every agent that wants to help our clients become more secure, because it is clear to us that this is where the industry is heading.

Data: Immunefi.

AI also helps find the bugs, not just write the reports. Before, researchers would report vulnerabilities in certain projects and might take weeks or months to move on to another client. Today, advanced researchers report several bugs across different clients in the same week. This discovery of vulnerabilities at scale is only possible thanks to the latest agents.

Almost all researchers use the same models. When a new model comes out, the same new vulnerabilities get discovered. There is certainly an art to using these agents to look for security flaws, which is why we see some researchers having more success than others. But the density of duplicates has indeed increased substantially. In an audit competition on Immunefi, the Quantus one, 77 of the 143 valid reports were duplicates, and one high-severity bug was reported 25 times. PHP2Shell followed the same pattern, with Calif and OpenAI arriving at the same root cause.

What humans let slip

Pragmatically speaking, humans failed. That's nothing new. The memory flaw at the origin of PHP2Shell had already been reported in 2020, as a seemingly harmless bug. In 2024, during an external audit, a PHP core developer saw the first signs of the problem. An exploit was theorized, but with no concrete vectors, and the fix dragged on for months. The PHP Foundation itself calls that delay a "structural failure", caused by the security team's decision process and its lack of resources.

Despite being code used across half of the internet, the discovery of security problems depends on the incentives put in place for such systems to stay secure and become ever more robust. This software is public, so it's not as though there is a billion-dollar company responsible for making sure it is continually hardened. The PHP Foundation has a single full-time employee and 14 contractors, almost all part-time. Node.js suspended its bounty program when the funding from the Internet Bug Bounty ended.

Every company that uses this software sets up its own protections, or at least some do, to try to ensure that a vulnerability in a dependency isn't lethal to them, and that the dependency is quickly updated with whatever fix is made upstream.

Still in its infancy

All of this is very new. Vulnerabilities are discovered and made public, and companies can barely keep pace in updating their dependencies and staying secure. As of May 22, Anthropic's Project Glasswing had disclosed 1,596 flaws to 281 open source projects, and only 97 were confirmed as fixed. Amazon recorded the first PHP2Shell exploitation attempt on October 17, four days before the fix. The Node2Shell fix sat in plain sight for eight months in the public Brotli repository, with no new version and no advisory.

Data: Cloud Security Alliance.

The problem with cybersecurity has always been that a company's cybersecurity is not the core of its business, and it is normal that it isn't. Companies are focused, naturally, on what makes them grow and serve their customers well. It follows that there isn't all the time and resources in the world for some companies to stop what they are doing and devote themselves continuously to fixing vulnerabilities.

This is a problem still in its infancy, and it will only get worse. The old bugs may run out, although there is a lot of code in which to discover problems, but new code keeps arriving, and at dizzying speeds. It will become increasingly necessary for companies to find dedicated partners to help them stay protected. But will there be budget for that?