PHP2Shell Shows Why Defenders Need Their Own Army of AI Agents

Attackers are hammering two critical PHP flaws, known as PHP2Shell, a day after PHP shipped emergency patches on Oct. 21.

The bugs let anyone run code on servers that use PHP to handle web requests without needing to log in.

Outside researchers reported the flaws to PHP, which shipped fixes for four supported branches.

According to VirusTotal, more than 5.1 million PHP hosts are exposed online, and Cloudflare's network logged millions of exploit attempts within a day of the patches' release.

What we know about the CVEs: two bugs, one bad request

Both bugs come down to bad cleanup. When a web request crashes partway through, say because it runs out of memory or hits a fatal error, PHP doesn't fully clean up after it.

An attacker can trigger that crash on purpose and use the leftover memory to run their own code on the server, no login needed.

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and PHP has fixed both in its latest releases for 8.2 through 8.5.

Older versions are the harder problem. PHP 8.1 and earlier no longer get official updates, so those servers need an upgrade or a backported fix.

While the announcement of bugs, even significant ones in major projects, is far from new, these vulnerabilities point to a new era of challenges for organizations in their struggle to keep their systems secure.

The coming vulnpocalypse: old code, new eyes

One of the unspoken truths of tech is that a lot of the internet still runs on code written a long time ago, and that code has bugs nobody has found yet.

The mitigating factor that kept the balance between attackers and defenders was that for years, finding significant vulnerabilities took a skilled researcher and a lot of patience.

Now, as we're learning, AI models don't need either to be wildly successful.

PHP2Shell is a good example. Glow Threat Intelligence traces both bugs back to PHP 5.4, released in 2012, so they sat in plain sight for 14 years.

Then Dan Lorenc, who helped test PHP's fixes, wrote that his team found the same issue in a single night after being briefed that a PHP flaw was coming. They used their own test harness and a frontier model, and the prompt was five words long: "find bad vulnerabilities in PHP."‍

Without stating the obvious, it shouldn't be this easy to break the internet.

And as we see, PHP isn't the only old codebase getting a second look:

• In April, Anthropic said its Claude Mythos Preview model found thousands of high-severity vulnerabilities across every major operating system and web browser, including a 27-year-old bug in OpenBSD.
• In June, OpenAI launched Patch the Planet with Trail of Bits, which reported hundreds of security issues across 19 open-source projects.

The industry is calling it Vulnpocalypse. AI is reading years of heavily used code faster than any human team could, so disclosures like PHP2Shell will keep coming, picking up the pace to be more than human teams can manage on their own.

Attackers don't wait for the advisory

Finding bugs faster is only half of the problem. The other half is how quickly attackers pounce. Matthew Prince, Cloudflare's CEO, said the company saw thousands of PHP2Shell exploit attempts in the 10 hours before PHP even announced the bugs.

Once the news was out, the numbers climbed fast: tens of thousands of attempts in 45 minutes, hundreds of thousands within two hours, and millions by Oct. 22.

As soon as the rumors were out, the defenders found themselves on the wrong end of a very nasty clock.

First, someone has to figure out where PHP is running, which is harder than it sounds. It hides inside bundled stacks like XAMPP and Laravel Herd, and Linux distributions package it under version-specific names such as php8.2.

Then every one of those hosts needs the right fix for its version and a restart, usually inside a change window. Done by hand, host by host, that's a serious time commitment against attackers who move in minutes.

That gap is why defenders need automation working on their side too.

Fighting agents with agents

When AI can surface a bug in a single night and exploit attempts climb into the millions within a day, a security team working ticket by ticket can't keep up.

Defenders need AI on their side too, an army of agents that handles the grunt work across the whole workforce so people can focus on the calls that need judgment. Glow puts those agents to work in three areas.

Visibility: know what's on every machine

The scramble after an advisory starts with figuring out who's exposed. Glow builds one inventory of the apps, packages, browser and IDE extensions, MCP servers, and AI tool configurations on every machine, reconciled across the EDR, MDM, identity, and browser tools a company already runs.

When something shows up that Glow hasn't seen before, AI research agents vet it, and threat intelligence flags anything vulnerable, malicious, or past its end of life. When the next advisory drops, the team starts with a list instead of a hunt.

Posture: decide what matters and adapt policies

Traditional security policies are static. Someone writes a rule, and it stays that way until someone updates it. But when new vulnerabilities emerge overnight, security teams can't afford to manually revisit every policy.

Glow's AI agents continuously connect threat intelligence, software exposure, and organizational context to recommend smarter policies and prioritize where action matters most. They identify which machines are affected, assess the potential blast radius, and help security teams decide what to block, fix, or allow. As risks change, agents recommend adjustments so policies keep pace without constant manual effort.

Control: stop bad software before it lands

Glow's various control points enforce prevention policies before anything is downloaded. A marketplace gateway blocks malicious packages and known-vulnerable versions on npm, PyPI, and Go, while other tools block anything on the team's blocklist, using the same threat intelligence that powers Glow's findings.

Glow also keeps watch inside the AI coding agents developers already rely on. In Claude Code, Cursor, and Codex, its runtime protection steps in while the agent is working, blocking secrets in prompts, risky MCP servers, and malicious package installs.

Putting AI to work for the defense

The same AI that's speeding up bug discovery and exploitation can work just as hard for defenders. Teams that know what they run and let agents carry the busywork will meet the next big disclosure with an actionable plan instead of a scramble.

The teams that come out ahead won't be the ones with the most people. They'll be the ones that let agents handle the busywork, so their people can focus on the decisions that matter.

Want to see what's running across your machines before the next advisory drops? Talk to the Glow team about getting a clear picture of your software inventory.