The time between a security fix and an attack is now measured in hours.

On Wednesday 21 October, PHP shipped fixes for two critical flaws that let an attacker run code on a web server without logging in, as The Register reported. The bugs, now known as PHP2Shell, had been in PHP for more than a decade. Researchers at Calif, OpenAI and Wiz found them in August and September using AI models.

Chainguard found the same bugs independently, the night it heard something was coming. Its CEO, Dan Lorenc, said all it took was a basic prompt: “find bad vulnerabilities in PHP”.

The CVE numbers leaked before the release was ready, and PHP brought it forward a day. Amazon says it saw an attempt to exploit the bugs on 17 October, four days before the fix was public. Cloudflare reported tens of thousands of attempts within 45 minutes of disclosure. Most reports so far are of attempts, not confirmed break-ins.

The clearest confirmed case came two days after the release. Palo Alto Networks’ Unit 42 described an attack on a European government body. Within two hours of the first exploit, the attackers had password hashes and multi-factor secrets. Unit 42 says the commands and behaviour were strong indicators of an AI agent doing the work.

Finding serious bugs like these used to take a lot of skilled time. Now it can take a model and a prompt, and attackers have the same models. I’d expect more of these, and less time between the advisory and the first attack. But hopefully also less time to fix. However, that still leaves systems vulnerable until patched.

There are three questions to answer before the next one lands.

Do you know what you run? That includes the language version, the base images, the libraries, and the things outside the main product, like the WordPress marketing site or the admin tool an agency built three years ago. PHP released fixes for 8.2 to 8.5. For 8.1 and older there was no official release. The PHP team published source patches, and some Linux distributions ship their own fixes, but you have to go and find them. And 8.2 stops getting security fixes on 31 December.

Who is watching? Pipeline scans flag a vulnerable PHP version or base image, but only when something gets built, so the service nobody has touched in months gets missed. I run a dependency audit every day, not just at build time. Make sure yours alerts someone who will act on it.

How fast can you ship a fix? If an advisory lands at 4pm, can you rebuild, test and deploy that evening? If deploying needs a developer who’s away until Monday, the answer is no. Know your fallback too. Cloudflare, Fastly and Vercel offered protections for customers who couldn’t patch straight away, per Wiz, but PHP says updating is the only safe choice.

None of this is new, but you now get much less time to do it.

When I do a platform review, I ask when the last critical advisory landed and how long it took to get the fix live.