PHPeril: Never Send a Human to Do a Machine’s Job

This article originally appeared in Galaxy Research's weekly newsletter. Subscribe to get timely insights delivered to your inbox every Friday morning. Find our past reports and newsletters at galaxy.com/research. Send feedback to [email protected].

WHAT HAPPENED

The team maintaining scripting language PHP rushed out emergency patches Wednesday for two decade-old bugs that let anyone on the internet run code on millions of servers without permission. The rest of the internet spent the day discovering how many other things were also on fire.

The bugs, collectively dubbed PHP2Shell, affect nearly every PHP version back to 5.4 (released in 2012). PHP quietly holds up WordPress, Drupal, Magento, and by some estimates, around 70% of the web. Cybersecurity firms Wiz and Calif found the bugs with help from OpenAI, and OpenAI says Calif found the bug with GPT-5.6 Sol, a generally available model. The plan was a tidy coordinated disclosure, and everyone has a plan until they get punched in the mouth. Details leaked, Amazon's honeypots logged an exploit attempt four days before the disclosure, and Cloudflare CEO Matthew Prince reported thousands of exploit attempts in the 10 hours before the patch release and millions by the evening.

The NSA and FBI told organizations to go offline if they couldn't patch, Japanese PM Sanae Takaichi urged site operators to act that night, Finland and several other European governments pulled sites preemptively, and the St. Louis Fed's FRED site went dark.

PHP was merely the headliner. This week's full lineup of cyber scares included a CVSS 10.0 GitLab bug, Railway pausing all deployments after someone got into its environment-variable store, Node.js patches, Plex servers exploited to mine crypto, SafePay ransomware, and eMudhra, an Indian certificate authority whose private keys were small enough to guess. One of them was the number 4. (Yes, that was the whole private key; easy to remember, but...)

OUR TAKE

The most worrying part of this story is that this internet-breaking exploit didn't come from those scary frontier models.

The PHP Foundation worked with outside firms to scan its code with Anthropic’s Claude Mythos this year, but this exploit was only discovered in early August as part of OpenAI’s Patch the Planet program. Even more shockingly, the exploit was discovered using GPT-5.6 Sol, a model you can pay for today, not one of the unreleased or cyber-specialized variants the labs keep caged up like a James Bond supervillain. Despite earlier testing with Claude Mythos, the vulnerability was identified through separate research using other AI models. Instead, it took a researcher’s intuition guiding a commodity model, and attackers have both.

The pace at which attackers tried to utilize the exploit is like nothing ever seen before. That is the new norm. Announcing a patch in advance is supposed to get administrators ready, but it also fired a starting gun for every bad actor racing to find the bug before the fix landed. That tension between preparing defenders and tipping off attackers was always delicate, and with more cyber-capable open AI models around, the announcement window will continue to compress toward zero. Threat intel and incident response firm Mandiant already puts mean time-to-exploit at negative seven days; attackers typically strike a week before a patch exists. The zero-day clock has struck midnight, and had an integer overflow as it kept going.

What this means is that human-only cybersecurity is truly obsolete, and untenable. Security in an agentic world must also be agentic; Hugging Face was the preview in July, breached by OpenAI’s own models during testing, and this is the new reality with broad access to capable coding agents. Machine-speed attackers need machine-speed defenders.

"Zion, hear me! It is true, what many of you have heard. The machines have gathered an army and as I speak, that army is drawing nearer to our home." – Morpheus ... or your dramatic IT security lead during an all-hands

You should be a little scared, I am. A lifelong nerd, I ran a personal server in high school, and in the late 2000s I had to learn some security practices because my little experimentation box was getting bombarded by automated SSH password-guessing, port-scanning, and general exploit attempts a full decade before the first GPT paper in 2018. The spiders were already probing everything. LLMs cranked that dynamic up to 11, then ripped the knob off.

I turned off my home server on Wednesday and unplugged most of my IoT devices until I have time to use the best available model to help me patch, replace, or reflash each one. If I write something testy about the DPRK, should I worry about them flipping my smart switches until something shorts? Do I have to root my Roomba to keep it from being taken over and trying to boop the power button on my PC? Most IoT software is forgotten after creation (when did you last patch your smart fridge?), and Anthropic's red team just ran a 26-billion-parameter model across 15 $55 Android TV boxes. With a long tail of vulnerable devices, botnets of hacked devices may graduate from DDoS attacks to distributed inference for whoever controls them.

All software stacks have been non-consensually thrown into the Thunderdome, but this is only the beginning of the battle. More exploits are coming, probably worse ones, but every serious patch and every agent-reviewed release strengthens the code the world runs on. A more secure internet is being born from its parents' death, like the Olympians descending to overthrow the Titans.

Some code is already ready for that world. Bitcoin Core is among the most heavily reviewed codebases on earth, and no comparable compromise has been reported. Most of these exploits exist because no human can hold an entire codebase in their head; almost nothing outside TempleOS was written by one person, and even that wouldn't guarantee spotting every step of an exploit chain. Agents, with long context and a shared, eidetic memory, can do the comprehensive reviews that human teams struggle with.

Modern cryptography held: nobody broke the algorithms the internet relies on. eMudhra fell on its face generating keys, not at math. At the peak of the panic, I recommended that our clients verify instructions by signing from their wallets, an additional safeguard against compromised intermediaries.

Security through obscurity is finished. There will be a culling of unmaintained websites, projects, and blockchains. It is not going to be pretty, but what survives will be an internet worth trusting. Just don't make your private key 4.

Educate yourself, protect yourself; it is going to get more dangerous before it gets safer. Put on your helmets, man the trenches with your agents, and hold the line. Don’t give the clankers an inch.