Fight fire with fire

PHP2Shell sat in PHP for six years until AI made it easy. If the attacker’s using AI, you have to as well, with control lines that check every fix.

Why did PHP2Shell sit there for six years?

Here’s the quick recap. PHP2Shell is a pair of critical flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619) that let an attacker run code on your web server without logging in. PHP shipped fixes on 21 October. (I wrote about the patch-window side in Early bird gets the shell.)

The bug underneath wasn’t new. Calif, the security research firm that found it, traces it to a PHP bug report from 2020, and says a 2024 audit rediscovered the same out-of-memory issue, but “exploitation was not proven, hence the bug was not fixed.” Fair enough. Turning that crash into a shell was a job for a tiny handful of people on the planet, so it sat there.

Then the AI arrived. Calif’s researcher found the route to code execution in August with what he called “my LLM companion”. Wiz, the cloud security company, found a second way in and said that “a single researcher completed in a week what previously would have taken a world-class team months of work.”

Suman Jana, an associate professor of computer science at Columbia University, put the shift well when he spoke to IEEE Spectrum. With AI, he said, “the top 0.1 percent [of experts] can get a lot more stuff done, and also just below the 0.1 percent now will be able to go there.” The bug didn’t get worse. The pool of people who can use it got a lot bigger.

And they were quick. Amazon’s honeypots caught someone trying the exploit four days before it was even announced.

So who’s got it wrong?

Anyone still defending at human speed. (Which, until recently, was all of us. Me included.)

Look at the maths. Finding the bug took a researcher plus AI about two weeks. Fixing it took the PHP Foundation a month from starting the fix to the release. Then every company on earth had to find its own copies and patch them, and the internet scanning firm Censys still counted over 32 million services on an affected PHP version five days later.

The usual answer is more people. Bank of America brought in 1,000 contractors when AI started exposing flaws in its software, which I argued is already out of date. You can’t hire your way to machine speed. If the attacker’s using AI, you have to as well.

Doesn’t AI fixing just start a second fire?

It can, which is why the control lines matter.

Jana, the Columbia professor, describes what good AI defence looks like: “The patch is LLM-generated, and then an LLM generates the proof that the patch is correct.” Then the important bit: “The only thing not done by an LLM is the proof checker, because somebody has to check the proof, because LLMs hallucinate.”

Anthropic has just shown why. On 22 October it published research, done with the formal verification company Theorem, where Claude wrote formal proofs that programs in 123 open-source libraries never crash, all checked by Rocq, a proof checker with no model inside. According to the write-ups, Claude produced around one billion lines of proof and about 180 million passed. Simple maths: roughly four lines in five didn’t survive the checker. (That’s not a dig at Claude. Writing proofs is mostly failing, for people too.)

Anthropic also says it audited patches for reward hacking, which is when the model makes the score go up without doing the work. It deletes the failing test, swallows the exception, or special-cases the exact input from the exploit. Green pipeline, same hole.

So the AI fire is fine. An AI fire with no control lines is how you end up offline and still exposed.

Isn’t checking just going to slow us down?

No, and that’s the bit people miss! Checking is the accelerator.

F1 cars don’t have huge brakes so they can go slowly. They have huge brakes so they can go flat out into the corner. Take the brakes away and the driver has to lift off everywhere.

Same with your agent. Without an independent check, a human has to read every AI patch, and you’re back at human speed with extra steps. With one, you can start with everything gated, watch which kinds of fix keep passing, and move those onto the list the agent does by itself, like bumping a patched base image or rotating an expiring certificate. Keep humans for the new, the weird and the big blast radius. That’s how you get fixes landing at 3am, at the attacker’s pace, without crossing your fingers.

Anyway, don’t fight an AI-speed fire with a garden hose. Here at Firemind we’ve built the IT Operations Engine to operate your cloud autonomously, with the gates built in. It raises fixes as pull requests your engineers review. Anything outside the agreed allow list stops and asks a human, and if your engineer approves, it proceeds with the approval on the record. Fixes that keep passing earn the right to run on their own, so your defence speeds up as it earns trust. Start with an eight-week pilot on one non-production cloud account, at no cost to you, funded through AWS POC funding.

👉 Scope a pilot