I waited to drop this because there are so many items to cover from this week and really wanted to avoid blowing up inboxes. I have observed many CISOs and Product Security leaders dismissing AI vulnerability discovery as mere marketing tactics from leading frontier model firms. While it is true (of course its marketing), it does not negate the reality of AI's capabilities or how they will permanently change the way your organization operates. No great impact will be felt than in the legacy (outdated software) medical device (high safety impact) and similar OT spaces.
Internally, we have been aware of this for almost two years and have consistently written about our vulnerability discovery harness (check out early issues). However, it has been perplexing why most cyber folks still think that AI-enabled analysis is merely a "scanner" or that a "human-in-the-loop" approach is necessary. If you know me, then you know I repeatedly subscribe to the fact that "human-in-the-loop" actually reduces the quality of vulnerability output. It's a fact at this point. This is because output must be simplified to a consumable format that aligns with a specific skill set of a human tester, and a significant portion of the output goes over the heads of everyone except the top 10% of security researchers. The outcome? It's dismissed or inconclusive simply because a human cannot replicate. These agentic discovery loops are running everywhere, and this week was great evidence.
Most of these vulnerabilities have been publicly identified by their respective identifiers as being discovered through some form of AI-enabled analysis. It is evident that these flaws have existed for years or even decades, making AI the true differentiator in this case. It is not all marketing hype. If you don't have Mythos or Daybreak Red, grab GLM and start doing analysis, it's that important to the security of your network, enterprise, and devices.
A critical bug surfaced in PHP, another in GitLab, ten in Node.js, a class of them across HTTP/3, an actively exploited chain in Plex, a certificate authority whose signing keys turned out to be trivially weak, and a poisoned release of one of the most common AI proxies in production. Nearly all of it inside a single week, and most of it on one day. This issue walks through what dropped, because the rate is the story this week, more than any one bug on the list.
The headline event is PHP2Shell, two critical flaws in the PHP interpreter itself, tracked as CVE-2026-109618 and CVE-2026-109619 and rated CVSS 9.2 by PHP's security team. PHP runs on roughly 70% of websites, so the blast radius is most of the web. Wiz Research called them among the most severe vulnerabilities found in PHP, and arguably in the history of software.
The flaws are memory-safety bugs in how PHP handles its own internal state after a request runs out of memory mid-processing. Because the bugs live in the interpreter rather than in any one application, every application on a vulnerable version inherits them, regardless of how carefully that application was written. The vulnerable code had been in PHP for about 14 years, back to version 5.4. The fixed releases are 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with backports for some older lines. Anything on PHP 7.x or earlier does not get a fix from the project and has to be upgraded.
How the bugs were found is the part that connects to the trend. A red-teaming firm called Calif found one of the two flaws on August 1 using OpenAI's GPT-5.6 Sol model, then reported it into OpenAI's coordinated disclosure effort. Wiz found the same vulnerabilities independently on August 19 using Google's Gemini 4 Argon, GPT-5.6 Sol, and its own tooling. Multiple organizations reached the same bugs around the same time, and all of them used AI to get there. A limited version of the issue had surfaced in 2024 and was judged minor at the time. The coordination ran through October, involving PHP, Cloudflare, Quarkslab, and several US agencies, until the patch and public advisory on October 21.
The schedule then broke. Details leaked on October 20, a day ahead of the planned disclosure, and the exploitation curve moved fast. Cloudflare's CEO reported thousands of exploit attempts in the ten hours before the public announcement, rising to tens of thousands within 45 minutes after it and to millions within a few hours. Censys scanned 2.6 million internet-facing hosts and found about 1.5 million still running an unpatched PHP version. Palo Alto put the count of potentially vulnerable instances near 22.6 million. Some operators took services offline rather than gamble on the gap, including parts of Wikipedia and government services in the Netherlands and Finland. The FBI and NSA both urged organizations to update immediately or pull affected systems. A model had found a 14-year-old flaw in the language that runs most of the web, and the whole response had to happen inside a single day.
The same day, GitLab shipped an emergency fix for CVE-2026-110264, a CVSS 10.0. A perfect score means unauthenticated, remote, low-complexity, and full impact to confidentiality, integrity, and availability. The flaw is an integer overflow in the regular-expression engine GitLab bundles, the one Ruby uses by default. User-supplied text that GitLab renders, such as issues, merge requests, wiki pages, and document previews, reaches that engine, which is how an attacker who never logs in can get to it. Every release back to version 7.0, shipped in 2014, is affected. GitLab backported the fix across seven branches and confirmed its own hosted infrastructure was already patched. No confirmed exploitation in the wild as of the advisory.
PHP2Shell and this GitLab bug make a useful contrast. The highest-rated flaw of the week came from a human researcher, joaxcar, through GitLab's HackerOne program, the same way critical bugs have been found for a decade. AI did not find everything this week. The strain comes from AI-found criticals and human-found criticals landing together, in the same week, stacked on each other, while the fix cadence on the receiving end stays where it has always been.
Node.js released its October security update the same day, patching ten vulnerabilities across its three supported release lines. The one that draws attention is an out-of-bounds write in the Brotli decompressor, CVE-2026-111497, which Node describes as allowing remote code execution. It becomes reachable when an application decompresses attacker-controlled data, which includes ordinary paths like a response handled through fetch. Alongside it sits a cluster of TLS hostname-verification bypasses, cases where a certificate's identity check can be fooled by oddly formatted IP addresses, so a client can be convinced it is talking to the right server when it is not. The fixes are in 22.23.4, 24.22.1, and 26.12.1. End-of-life versions do not get them.
Node is the quiet entry on the list. It sits underneath a large share of backend services and device companion software, and ten flaws in it, patched on the same crowded day, is the kind of thing that gets lost in a week like this one.
On October 20, researcher Sébastien Féry of FoxIO published "header accordions," a class of memory-exhaustion weaknesses in how HTTP/3 servers decompress request headers. The compression scheme, QPACK, lets a client send a small amount of data on the wire that expands into a large amount in server memory. Where a server fails to bound that expansion, a modest request inflates into enough memory pressure to stall or crash it. Féry measured amplification ranging from about 15 times the wire size up to roughly 4,000 times on one implementation, and reported that a single connection can be enough to exhaust a default-configured server.
He tested ten HTTP/3 stacks and found seven affected, including quic-go, Cloudflare's quiche, lsquic, Bun, and others. Some have shipped fixes, and some carry only configuration mitigations for now. The HTTP/3 work is the research-grade item on the list, a design pattern that shows up across an ecosystem rather than in a single product, and like GitLab it came from a human working carefully through a protocol.
Plex Media Server rounds out the code flaws, and it is the one already under active exploitation. Researcher Zach Main chained four flaws, the most serious a server-side request forgery, into a path that can hand an attacker the owner's admin token and code execution. He reported them in July and published details on October 16. In-the-wild exploitation appeared on October 17, first dropping a cryptominer and then proxy malware that routes traffic through the victim's connection. CISA added the chain to its Known Exploited Vulnerabilities catalog on October 20 with a federal remediation deadline of October 23. The fix has been out since early August, in version 1.43.3.10861 and later, which means the exploited servers are the unpatched ones.
Two more events the same week were not code bugs, but they belong in the picture because they hit the layers everything else depends on.
eMudhra is a certificate authority, one of the organizations browsers trust to vouch that a website is who it claims to be. A faulty script during an April 2025 key ceremony generated eight intermediate signing keys that were catastrophically weak. A proper private key is a random number well over a hundred digits long. These were small enough that one was the integer 4, and the rest were recoverable by testing at most 256 values. A researcher recovered them from public certificates in under a second. Within days, Chrome, Firefox, Safari, and Edge blocked the affected certificates, and about 30,000 certificates now need to be replaced. Nothing about the failure was sophisticated. A certificate authority exists to keep its signing keys secret and strong, and eMudhra did neither.
LiteLLM, a widely used open-source proxy that routes requests to different LLM providers, shipped a compromised release, version 1.107.0, to PyPI, Docker Hub, and GHCR. The malicious build carried an information stealer that targets cloud credentials, passwords, and AI-provider keys, along with a remote-access trojan. It was disclosed on October 21. The AI infrastructure layer itself took a supply-chain hit in the same week the AI-found bugs landed.
None of this is a coincidence of timing, and the reason sits one layer down, in how bugs are now being found.
Three months ago, in July, a model found a pre-authentication remote code execution chain in WordPress core, called wp2shell, discovered by Searchlight Cyber using GPT-5.6 Sol, and this week it was PHP2Shell. In between, OpenSSL's maintainers have been saying out loud that they are overwhelmed. Their open pull requests climbed from 309 to 558 year over year, and their CTO described early AI-generated reports as "AI slop" before adding that in 2026 "everything exploded." Their executive director, Matt Caswell, said security reports are cheap to write and still expensive to assess. Google paused part of its open-source bug-bounty program over a flood of invalid AI submissions.
The same capability that found the PHP flaw is pointed at every maintained codebase at once. Most of what it produces is noise that maintainers triage by hand, and a small fraction is a PHP2Shell. The ratio does not have to be good for the volume alone to change how defense works, which is what this week showed from the outside.
Device makers are slow patchers by construction. A fix to fielded firmware goes through verification and regulatory coordination before any hospital deploys it, and that cycle runs in months. PHP, Node, and libraries like them ride inside device backends, companion apps, and cloud services, and sometimes on the device itself. A 14-year-old flaw in a core interpreter is exactly the kind of dependency that sits unnoticed in a fielded stack, inherited by every application above it, waiting for someone to look.
The shift this week was in the discovery rate, not in any one bug, while the fix cadence for devices stayed where it has always been. Section 524B asks manufacturers to address postmarket vulnerabilities within a reasonable time, and that expectation was set against a world where criticals in core dependencies arrived at a human pace. PHP went from leak to mass exploitation in hours, while validating and shipping a fix to a Class II device in a hospital closet still takes months. The exposure lives in that gap, and it widens every time discovery speeds up and the fix side does not.
With 13 years of experience in this industry, we have developed the tools to defend against this threat. This week's vulnerability drops represent a small skirmish in the larger war that manufacturers will wage against the discovery of AI vulnerabilities and the justification of exploitability within their products. Manufacturers need to know evidenced exploitability in hours, not days or weeks.
Real on-product exploitability verification →I am watching whether AI-found criticals in core dependencies settle into a cadence rather than staying a once-a-quarter shock. wp2shell in July and PHP2Shell this week are two points, too few to call a trend yet, but the OpenSSL maintainers' inboxes suggest the supply is already here and mostly just hard to sort so far. The other thing I am watching is the gap between leak and patch for fielded devices, since that is the window an attacker gets, and nothing announced this week makes it any narrower.
---
Sources: Wiz Research, "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet," and Patchstack, "Major security alert: PHP vulnerable to critical RCE," October 21, 2026, on CVE-2026-109618 and CVE-2026-109619. Axios and Fortune, October 21, 2026, on the AI discovery by Calif (GPT-5.6 Sol) and Wiz (Gemini 4 Argon), the coordinated disclosure, and exposure figures from Censys and Palo Alto Networks. GitLab Critical Patch Release 19.5.1 advisory, October 21, 2026, on CVE-2026-110264. Node.js October 2026 security releases, October 21, 2026. FoxIO (Sébastien Féry), "Header Accordions: QPACK amplification attacks against HTTP/3 servers," October 20, 2026. BleepingComputer and CISA KEV, October 20, 2026, on the Plex2Shell chain (CVE-2026-96652 and related). Help Net Security and BleepingComputer, October 20 to 21, 2026, on the eMudhra CA key compromise. The Hacker News and The Register, October 21, 2026, on the LiteLLM 1.107.0 supply-chain compromise. Cyber Magazine, October 15, 2026, on AI report volume at the OpenSSL Foundation. Wiz Research, July 2026, on the wp2shell WordPress chain (CVE-2026-63030, CVE-2026-60137).