Two long-hidden bugs went from overlooked to exploitable in days, and AI helped get them there. Here is what changed and how to defend against it.
In 2024, a PHP core developer noticed a problem. When PHP hit its memory limit in the middle of certain operations, it could leave internal data half built. Cleanup code would then trust that broken state.
It looked dangerous. Nobody showed it could be exploited. The fix stalled for two years.
In October 2026, AI-assisted researchers turned that weakness into PHP2Shell: unauthenticated remote code execution against WordPress, Drupal and Joomla. Attackers were probing for it four days before PHP shipped a fix. The same week, an AI security tool surfaced Node2Shell, a bug that had sat in a widely used compression library since 2018. Within two days of the patch, CISA confirmed attackers were exploiting it.
These are not isolated stories. They are early signs of AI-augmented cyber attacks: attacks where AI does part of the work that used to require rare human skill.
What Makes a Cyber Attack AI-Augmented
Every attack runs through the same stages. AI is now speeding up each one.
Find the weakness. AI reviews code and spots flaws, including ones humans already looked at and dismissed.
Make it exploitable. AI chains flaws together, debugs failed attempts and adapts an exploit to each version and configuration.
Run the attack. AI agents pick targets, run tools, read results and adjust.
What makes AI different is not that it knows tricks humans don't. It is that it never stops trying. At each step of an exploit there can be dozens of possible ways forward. A human researcher has to bet on the few most likely, because writing, testing and tweaking a custom script for each one takes hours. An AI agent can write a one-off script for every option it can think of, run it, read the failure, adjust and try again. It often finds the hole humans missed. Humans could have found it. Testing every path at every step just never made sense for a person.
That changes the scale. One attacker steering AI can now explore more paths than whole research teams could before. AI adds capacity, not just capability.
For years, the hard part was stage two. Plenty of weaknesses were known but too difficult to weaponize. That difficulty was a quiet layer of defense. AI-augmented cyber attacks remove it.
PHP2Shell: From Theoretical to Exploitable
Every security team has a backlog of findings marked "theoretical." Every team has deferred a hard fix because no one had shown it could be exploited. PHP made exactly that call. The PHP Foundation later called the delay a structural failure.
Then Ryan Austin of the research firm Calif went to work with an AI model. Calif says it used no special tools, only models "generally available to everyone." Its process looked roughly like this:
- Find a way for ordinary requests to exhaust PHP's memory allowance.
- Find code that marks data as valid before it is fully built.
- Follow that half-built data to code that later trusts it.
- Have AI turn the pattern into instructions for finding the same flaw elsewhere.
Then came the part that usually takes longest. Memory corruption exploits are fragile. Calif describes its AI agent tracing the path from the bug to a working exploit, and the pattern it wrote up pointing its agents to a second exploit route. Wiz, which also reported PHP2Shell, says frontier models let its researchers adapt working exploits across multiple applications in hours.
The researchers still mattered. They asked the right questions and steered the work. But AI cut the cost of turning "this looks dangerous" into "this works reliably." That is stage two of an AI-augmented cyber attack, and it is the stage that used to protect us.
Then the timeline collapsed. Word of PHP2Shell leaked on October 20, two days ahead of the planned disclosure, and PHP shipped its fixes a day early. Amazon Threat Intelligence reported a PHP2Shell exploitation attempt dating to October 17, four days before the fixes. Amazon says it is unclear whether that attempt would have worked. Attackers were still moving before defenders could patch.
CVE-2026-109618 and CVE-2026-109619: PHP2Shell, Remote Code Execution in PHP Core
A memory weakness first spotted in 2024 was not treated as exploitable. In 2026, researchers using AI turned it into unauthenticated remote code execution. It affects PHP 8.2 through 8.5 before 8.2.35, 8.3.36, 8.4.27 and 8.5.12, released October 21, 2026. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on October 26, 2026.
Sources: CVE-2026-109618; CVE-2026-109619; PHP security advisory.
Node2Shell: AI Finds What Humans Missed
Khai Tran and Sylvie Mayer of OpenAI Codex Security, an AI tool for finding vulnerabilities, reported a flaw in Brotli. Brotli is a compression library bundled into Node.js and many other runtimes, proxies and HTTP libraries. The flaw is now known as Node2Shell. It is also being called HTTP2Shell and Broccoli2Shell, because the same bug reaches Python, .NET and Perl packages, not just Node.js.
The bug had been in Brotli since 2018. A fix landed in the public source code in February 2026, with no release and no advisory. Nobody recognized it as a security issue, so the software people actually ran stayed vulnerable for another eight months.
Once the impact was clear, things moved fast. Brotli and Node.js shipped fixes on October 21. Within a day, a public proof of concept was on GitHub, and independent researchers showed code execution against an official Node.js build. Bun, Envoy, Python packages and others followed with their own updates.
Two days after the patch, CISA rated Node2Shell as actively exploited. On October 26, a threat intelligence firm captured one of those attempts in the wild. It failed in the firm's own testing, but attackers were clearly already trying.
AI did not just build an exploit faster here. It found security impact that humans had looked at and missed. Once that impact is public, the clock to exploitation runs in days.
CVE-2026-111497: Node2Shell, Out-of-Bounds Write in the Brotli Decoder
A flaw present in Google Brotli 1.0.3 through 1.2.0 since 2018, bundled into Node.js and many other runtimes. A crafted compressed stream lets a remote attacker corrupt memory and potentially run code. OpenAI Codex Security found it. It is fixed in Brotli 1.0.10, 1.1.1 and 1.2.1, Node.js 22.23.4, 24.22.1 and 26.12.1, and Bun 1.4.4. CISA rates its exploitation as active.
Sources: CVE-2026-111497; Node.js security release.
Attackers Have the Same Tools
PHP2Shell and Node2Shell were first weaponized by researchers working through coordinated disclosure. That is the good news.
The bad news is that the tools are not special. Calif found PHP2Shell with models available to everyone. Anything a researcher can do with a public model, an attacker can do too.
Attackers are not waiting either. Amazon saw a PHP2Shell attempt before the fix shipped. Within two days of the Node2Shell patch, CISA rated it as actively exploited. Five days after the PHP2Shell patch, CISA added both of its CVEs to the Known Exploited Vulnerabilities catalog. There is no public evidence that AI built those attacks. As AI speeds up stages one and two, the window between a disclosed weakness and a live attack keeps shrinking.
Stop Waiting for a Working Exploit
For years, "no known exploit" was a reasonable way to triage. Exploits were expensive to build, so a flaw without one could wait. Teams accepted the risk, added a compensating control and moved on.
That logic is gone. PHP2Shell sat for two years because no one could prove it was exploitable. Node2Shell's fix went unreleased for eight months because no one recognized it mattered. In both cases, AI closed the gap.
So stop waiting. If your code still calls strcpy on untrusted input, replace it with a bounded copy now, not after someone shows you the exploit. If a dependency has a known flaw, update it. If a finding is rated low, fix it anyway. In an exploit chain, low-severity findings are the links, and AI will try every one.
Not every bug will become an attack. But you no longer get to know in advance which ones will. Fixing everything used to be impossible at human speed. With AI Auto-Remediation, it isn't.
Related BlogAI-Augmented Attacks: How Attackers Use AI to Chain Small FlawsAI-augmented attacks are attacks where an adversary uses AI tools to do work that used to take skill and time: decompiling apps, reading obfuscated code, mapping APIs, writing exploit code and linking several minor weaknesses into one working attack path. The flaws are not new. The speed and scale are.Read Now
Defending Against AI-Augmented Cyber Attacks
In 2026, waiting for proof of an exploit before fixing is no longer a strategy. Neither is a compensating control left in place of a fix. A control that stands in for a fix guards one path, and AI tries every path. One crack anywhere and it stops protecting what it was meant to protect.
The answer is the oldest principle in security, defense in depth, run at AI speed. Find every weakness across code, apps, APIs and cloud, including the libraries buried in your apps that nobody inventoried. Use AI Exploits to run the attacker's playbook against your own apps first, so you see the chains before anyone else does. Fix what you find with AI Auto-Remediation, not just the findings someone proved dangerous. And when an attack starts before the fix ships, AI Active Protection stops it quickly and buys your team time to fix. It is cover while you fix, not a reason to skip the fix.
AI-augmented cyber attacks are moving faster. Your defense has to move faster too.
Schedule a demo to see how Data Theorem finds and fixes risk across your stack before AI finds it first.
Schedule a demoSources
