wasn't considered significant
The PHP flaw that took government websites offline this week had been in the code for fourteen years, and a limited version of it was found in 2024 and waved off. Severity was never a property of a bug. It was a price, and every severity rating in every bug tracker was quoted at the old price.
Fortune’s account of php2shell has one sentence I keep coming back to. The bug had been in PHP for fourteen years, and “a limited version of it had been discovered in 2024 and wasn’t considered significant at the time.”
Two years later the full version came out as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10. A single unauthenticated request could run code on the server, in some setups before any application code ran. PHP runs something like 70% of the web. Calif, an AI red-teaming firm, found the first piece on 1 August using one of OpenAI’s models, and Wiz found more on 19 August. Both were working under OpenAI’s “Patch the Planet” program. The PHP Foundation shipped fixes on 21 October. Reports leaked late on the 20th, and Cloudflare saw tens of thousands of exploit attempts within 45 minutes. Amazon’s honeypots had logged one on the 17th.
Then something I haven’t seen before at this scale. The UK’s National Cyber Security Centre told organisations that couldn’t patch to “consider taking the system offline,” and plenty did. Finland’s government web services went dark. So did the Dutch cybersecurity agency’s own site, parts of Wikimedia, ANA, JR West and MUFG. Japan’s prime minister asked companies to consider suspending services.
what changed
OpenAI’s summary is honest about it: “The vulnerable code had been there for more than a decade – what AI changed was the ability to understand the weaknesses and turn them into a working exploit.” Help Net Security put it the same way: the flaws needed exceptionally complex exploitation, and frontier models brought that barrier down.
Nothing about the bug changed. The code in October was the code in 2024. What changed was what it cost to turn it into a shell.
Georg Simmel argued in The Philosophy of Money (1900) that value isn’t a property of an object. It comes from the distance between you and the thing you want, and from what it costs to close that distance. Something within easy reach isn’t valued, and neither is something so far off nobody can get to it. Value sits in the middle, where getting the thing is hard but possible.
A bug works the same way. To an attacker, a flaw that takes six months of expert work to weaponize is worth about nothing. It’s out of reach. The 2024 finding was out of reach. Then the cost of reaching it dropped from months of expert time to a few weeks with a model, and a bug nobody wanted became the most wanted thing on the internet. Severity was never a property of the bug. It was a price.
CVSS, the scoring system behind that 9.2, admits as much. One of its inputs is attack complexity: how much has to go right for the attacker. It’s a price field. It’s been filled in for decades by people estimating what an exploit would cost a skilled human.
every ’low’ is a quote
Last week I wrote about Microsoft’s record month, and how a CVE count mostly measures how hard someone looked. This is the other half. Cheap finding inflates the new count. Cheap exploiting reprices the old judgments.
Every mature bug tracker has a long tail of tickets marked low, theoretical, “requires unlikely conditions,” won’t fix. Each one is a judgment that exploiting it would cost more than it was worth. Each one was reasonable when it was made, and each one is a quote in a currency that has lost most of its value. Nobody is going back through them one by one at the old pace. That’s why the advice this week was to pull the plug. When a whole category of risk gets repriced overnight, you can’t patch your way through it. You go dark and patch in private. The PHP Foundation only shipped fixes for 8.2 and newer, so for anything older, going dark and upgrading is the whole plan.
the call you made in 2024
If your job includes triage, you’ve made the 2024 call. You read a report, judged it not worth fixing yet, and moved on. You weren’t wrong. You priced it correctly at the time.
The trouble is that your old calls are going to be read at today’s prices. The incident review that follows a breach won’t ask what an exploit cost in 2024. It’ll ask who saw it and closed it. A judgment that was sound when you made it reads, in hindsight, like a miss with your name on it.
Two things follow. First, write the price down. “Low: needs an attacker to win a memory race under a specific config” is a dated quote that can be re-checked later. “Low” on its own is a verdict, and verdicts get pinned on people. Second, run your own backlog of lows through the same models the attackers are using, before they do. The cost that changed for them changed for you too.
The 2024 finding wasn’t a mistake. It was a quote, and quotes expire. This month a lot of them expired at once.
Sources: AI helped discover the PHP vulnerability that could take down 70% of the internet, Fortune ↗ · PHP2Shell: all you need to know about CVE-2026-109618 and CVE-2026-109619, JFrog ↗ · PHP2Shell: critical PHP vulnerabilities patched, Help Net Security ↗ · Critical security issue affecting PHP, NCSC ↗ · PHP flaws found by AI force governments and major sites offline, Paubox ↗ · Websites shut down globally as operators address AI-detected flaw, CNN via ABC7 ↗ · CVSS v4.0 specification, FIRST ↗ · The Philosophy of Money, Wikipedia ↗