On 21 October 2026, PHP patched two flaws that allow remote code execution without logging in, and several European government agencies took websites offline to patch. Through October, critical bugs kept arriving in quick succession. Is AI making software less secure, or just making old bugs surface faster? The short answer: disclosed vulnerabilities have doubled this year and AI-credited finds are up more than 20 times, but exploitation grew far more slowly: about 20% by CISA's count. What changed most is speed, from disclosure to attack, and the bottleneck has moved to the people who patch.
I read the primary reports from Google Threat Intelligence Group (GTIG), VulnCheck, CrowdStrike and Anthropic, an independent analysis of the full CVE list, and coverage in the Vietnamese press. This post puts them in one place: what happened, what the numbers say, the ways AI is involved, and what the numbers don't prove.
October 2026: PHP2Shell and a month full of vulnerabilities
The month's biggest event was PHP2Shell: two memory bugs in PHP itself (CVE-2026-109618 and CVE-2026-109619), each scored CVSS 9.2. According to Cloudflare, they affect every web server running PHP 5.4 or later, and were disclosed jointly by Calif, Wiz, OpenAI and Quarkslab. The timeline below combines Recorded Future's analysis, the php.net news archive and the Vietnamese press:
| When | What |
|---|---|
| Early Aug | Ryan Austin of Calif finds and reports a bug to PHP (per Duong Ngoc Thai) |
| 19–24 Aug | Wiz Research finds a PHP bug and reports the vulnerabilities to PHP (Recorded Future) |
| 20 Oct | PHP pre-announces an emergency security release for the next day |
| 21 Oct, 02:29 UTC | An archive with vulnerability details leaks to VirusTotal |
| 21 Oct, 07:34 UTC | Patchstack gets reports of real exploitation from hosting partners |
| 21 Oct, 13:52 UTC | PHP ships 8.5.12, 8.4.27, 8.3.36 and 8.2.35 |
| 21–22 Oct | France and the Netherlands take some government sites and services offline (Tuoi Tre) |
| 22 Oct | Vietnam's Department of Cybersecurity and National Cybersecurity Association advise a review and "not worrying excessively" (VietNamNet) |
| 23 Oct | PHP announces CVE-2026-115560, narrower, not yet patched |
Vietnam is not on the sidelines. VnExpress, citing BuiltWith, counts about 143,000 websites in Vietnam running PHP. Calif, one of the teams that found the bugs, is run by Vietnamese engineer Duong Ngoc Thai. On the same 21 October, CrowdStrike published four threat actors using AI agents (more below), and LiteLLM, a proxy that routes requests to many language models, had malware slipped into its release packages.
Disclosed vulnerabilities in 2026 have doubled
From 1 January to 23 October 2026, 86,292 CVEs were published, 2.2 times the same window of 2025 and more than all of 2025 (48,151). These figures come from CyberHire's analysis of a full CVE list download taken on 23 October. A few of them:
| Metric (1 Jan–23 Oct) | 2025 | 2026 | Growth |
|---|---|---|---|
| All CVEs | 38,569 | 86,292 | 2.2× |
| Critical CVEs | 3,348 | 9,599 | 2.9× |
| CVEs in September alone | 4,319 | 14,934 | 3.5× |
| Google Chrome CVEs | 110 | 3,593 | 33× |
GTIG sees the same trend month by month: monthly CVE disclosures went from 5,045 in January to 10,740 in August, per Help Net Security's summary of the report.
AI is doing the finding: from 34 to 769 credited CVEs
CVEs that name an AI system or an AI lab's research team as the finder went from 34 to 769 over the same window. Per CyberHire, the most came from Anthropic/Claude (335), AISLE (296) and OpenAI (112), and almost half (376) are rated high or critical. Affected projects include OpenSSL, curl, PostgreSQL, FreeBSD, Mozilla and GitLab.
769 is still under 1% of this year's CVEs, and it is a floor. GTIG explains why the public count is low: CVE records have no standard tag for "found by AI", and cloud and SaaS providers often fix such bugs without requesting a CVE ID. GTIG also found that 50% of likely AI-discovered flaws lead to remote code execution, against 26% of flaws found other ways, and attributes this to research programs pointing their AI agents at infrastructure and privilege boundaries.
The bugs themselves are not new. PHP2Shell has been in the code since PHP 5.4, released in 2012. In a column on VnExpress, Duong Ngoc Thai writes that it belongs to a bug class hacker Stefan Esser found back in 2004. AI didn't create these vulnerabilities. It made finding them cheap, and that cheapness is available to everyone: defenders, researchers and attackers.
More bugs found has not meant proportionally more bugs exploited
Vulnerabilities doubled, but exploitation grew much more slowly: about 20% by CISA's count, more by GTIG's. In all three sources below, the exploited share stays far below the growth in disclosures:
- GTIG: only 0.23% of 2026 CVEs (about 1 in 431) were observed exploited in the wild. January–August 2026 saw 141 exploited vulnerabilities, more than the 127 in all of 2025. Exploited zero-days rose from an average of 8 to 11 per month.
- VulnCheck: of 1,061 vulnerabilities attributed to AI-assisted discovery, 14 (1.3%) have been confirmed exploited, close to the rate across all vulnerabilities in the first half of 2026.
- CyberHire: CISA flagged 195 of the 2026 CVEs as actively exploited, against 163 in 2025. By CyberHire's figures, the exploited share fell from about 0.45% to 0.25%.
Bugs being found are growing far faster than bugs being exploited.
The chart puts the growth rates side by side. AI-credited bugs grew more than 22 times, all CVEs 2.2 times, exploited bugs only 1.2 times. None of the sources explains the gap in detail. Likely reasons are that many new bugs are hard to exploit, sit on code paths few people reach, or get patched before anyone uses them. Both PHP2Shell CVEs have "high" attack complexity in their CVSS vectors (GHSA-6wmf-4rv5-p3rp, GHSA-w8hw-w9fx-j79w).
What really changed: the time from disclosure to attack
The gap between disclosure and exploitation is shrinking from weeks to days or hours, and that is the part wearing operations teams down. GTIG's example is CVE-2026-1731, an unauthenticated OS command injection in BeyondTrust's remote access products, found by the Hacktron AI research agent. One threat cluster exploited it within four days of disclosure, five more within seven days. GTIG suggests attackers may be using large language models to rapidly weaponize already disclosed bugs (n-days).
PHP2Shell moved even faster: details leaked at 02:29 UTC, real exploitation was reported at 07:34, and the patch shipped at 13:52 the same day. For several hours before the patch, a WAF was the main protection available: Cloudflare's rules went live at 03:02 UTC. A public patch is also a map: diff the code before and after and you know where the bug is, and that is exactly the kind of work AI does quickly.
Attackers are already using AI agents
AI agents are no longer something only seen in defenders' demos. On 21 October, CrowdStrike published four previously unreported threat actors that used AI agents to make decisions and run commands during intrusions between May and August 2026. It assesses with moderate confidence that agentic AI turns baseline offensive operations into a commodity, and with high confidence that agent-supported intrusions will almost certainly increase in volume and sophistication.
Anthropic's September 2026 report on misuse it disrupted shows the speed in concrete terms. One financially motivated group dumped more than 2,100 Azure AD token sets across 40+ tenants in about 34 hours. Another case went from a single stolen developer token to full cloud admin in about three hours. The report also notes that a campaign's sophistication is no longer a reliable clue to who is behind it, because AI has narrowed the gap between well-resourced state operations and individual operators.
AI software itself is the new target
CVEs in AI software went from 505 to 3,191, 3.7% of all 2026 CVEs (CyberHire). GTIG counted 2,076 vulnerabilities in AI-related software from January 2025 to August 2026, over 1,500 of them disclosed in 2026. About half sit in agent orchestration frameworks such as Flowise and Langflow, where code execution nodes can be abused. Inference and serving software (vLLM, Ollama, LiteLLM) had 212 disclosures in 2026, nearly a quarter involving unauthenticated APIs or SSRF.
The attackers' interest is practical. A compromised AI gateway holds the API keys of every provider behind it. Anthropic's report records AI API keys and session tokens becoming loot in their own right: free compute plus a layer of attribution cover. If you run LiteLLM, Langflow or a self-hosted agent framework, that is internet-facing software like any other, and it needs patching and least privilege like any other.
The bottleneck has moved to the people who patch
Finding bugs now runs at machine speed, while fixing them still runs at human speed. PHP runs about 70% of websites (W3Techs, via VnExpress), but according to Reuters via The Standard, the PHP Foundation has one full-time staff member, its executive director, plus 14 mostly part-time contractors. The project receives nearly twice as many proposed code changes as a year ago, while the number of contributors hasn't doubled.
Junk reports make the bottleneck worse. When it set up its ecosystem security team in May, the PHP Foundation wrote that many projects report a drastic increase in vulnerability reports, many bearing the hallmarks of lazy AI generation. The curl project went further and ended its bug bounty at the end of January 2026 to remove the incentive for low-quality reports.
For operators, the bottleneck is a simpler question: what am I running, and which version? The four steps Vietnam's Department of Cybersecurity recommended for PHP2Shell start exactly there: list every server, website and container using PHP with its version, and only then patch, add WAF rules and watch logs.
What these numbers don't prove
None of the sources above proves that AI caused CVE volume to double. CyberHire's author says so plainly: most large vendors don't disclose how bugs were found, so the data can't separate out AI's share. Numbering has changed too: some issuers moved to one CVE per bug instead of one per patch, and 1,662 organizations issued CVEs this year that issued none last year. And 2026 isn't over.
The figures on AI-agent attacks come from companies that sell security or AI products. They are real evidence about specific cases, not a representative statistic. And this post can't answer the question you care about most: is your website safe? Only a list of what you run, with versions, answers that.
Summary
- From 1 January to 23 October 2026 there were 86,292 CVEs, 2.2 times the same window of 2025. AI-credited CVEs went from 34 to 769, and that is a floor.
- Exploitation grew far more slowly: about 20% by CISA's count. The exploited share fell to about 0.23–0.25%.
- What really changed is speed: PHP2Shell was exploited before its patch shipped, and an AI-found BeyondTrust bug was exploited within four days.
- Attackers already use AI agents, and AI software (gateways, agent frameworks, API keys) is a new target.
- The bottleneck is patching and knowing what you run. Start from your software and version list, not from CVSS scores.
If you run systems and changed how you triage and prioritize vulnerabilities this year, I'd love to compare notes. My email is on the home page.
Top comments (0)