AI found PHP2Shell. What can the AI on your laptops do?

Key takeaways

• AI did the hard part of a real discovery. Two teams used AI to find PHP2Shell, a decade-old flaw in PHP, and Wiz says one researcher did in about a week what would have taken a world-class team months.
• The same capability is on your laptops. Coding agents run with your developers' keys and connections, and some run with no one approving each step.
• People mostly keep agents on a leash. In a May 2026 survey, 63% rarely or never let agents run on autopilot. But Anthropic reports that users accept 93% of permission prompts.
• So the control has to sit outside the agent. Check what is installed, how freely it acts, and what it can reach.

On 21 October the PHP project shipped emergency fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619. Researchers call them PHP2Shell. Both allow unauthenticated remote code execution, both are scored 9.2 on CVSS v4.0, and Wiz says every PHP release from the last decade has at least one of the bugs, back to PHP 5.4. Estimates put PHP behind roughly 70% of the websites whose server-side language is known.

This post is not about PHP. EndLayer does not patch web servers, and if you run PHP you should update it. It is about how the bugs were found, because that is the part that applies to AI on a company laptop.

How the flaws were found#

Two teams found them independently, and both say AI did real work.

Calif joined OpenAI's Patch the Planet initiative on 30 July and reached its first finding on 1 August, "only a few days" into the audit. Its write-up names no special model and says no unreleased models were used. A researcher picked the target and steered the search using what he knew of PHP's history. The model found ways past PHP's memory limit, and an agent reading the source spotted a bug in the hash table code. The team then had the model turn that pattern into a reusable skill, which led to a further finding.

Wiz found its first bug on 19 August and confirmed unauthenticated code execution against Drupal the next day and WordPress the day after. It used its own tool, Wiz Atlas, with the Gemini 4 Argon and GPT-5.6 Sol models, including to adapt exploits across PHP versions and configurations. Wiz says a single researcher finished in about a week work that would previously have taken a world-class team months. It reported the flaws to PHP on 24 August.

Who did what#

Neither team says the AI worked alone, and both accounts are self-reported. The split they describe is consistent.

The caveat that matters: who got there first#

OpenAI says that, to its knowledge, frontier AI found the flaws before attackers did. That is a claim about discovery, and it may well be true. It is a separate question from whether the bugs were attacked before the fix. Cloudflare said the same day that its firewall had been blocking exploit attempts since 03:02 UTC on 21 October, that the flaw leaked before the official release, and that attackers were changing payloads to get around its rules. Other vendors, including watchTowr, reported attempts around the time the patches landed, and sources differ on the timing. The two accounts are not incompatible. Defenders can find a flaw first, and it can still leak.

Windows are shorter than reviews#

Rapid7's Q3 2026 update finds that, on average, high-severity vulnerabilities were exploited three days after public disclosure. Of the 43 newly exploited vulnerabilities it tracked, 71% were exploited within a week.

If AI also shortens the time it takes to turn a fix into a working exploit, as the researchers argue, those windows get shorter again. That is the news. What it means for AI agents is the next section.

The same capability, on a laptop#

Take away the PHP and the discovery shows something simple: an agent given source code, tools and time can do skilled technical work with a person mostly steering. Your developers have that. A coding agent runs under their login, reads whatever repository it was opened in, runs shell commands, and talks to other systems through MCP servers. Many hold a provider API key in a file.

How much of that happens without a person approving each step is called autonomy, and the data says people are cautious but not consistent.

59%

of technologists now use agents at work, up from 31% a year earlier (Stack Overflow, April 2026, 1,100 respondents)

63%

rarely or never let agents run on autopilot (same survey)

60%

block agents from making unapproved system changes (same survey)

93%

of manual permission prompts are accepted in practice, which Anthropic calls approval fatigue

The two ends of that data pull in different directions. Most people say they keep agents on a leash. But when Anthropic looked at what happens at the permission prompt, users accepted 93% of them. That does not mean those 93% were wrong. It means a prompt is a weak control once people have seen the same one hundreds of times.

Anthropic's answer is auto mode, which hands approvals to a classifier. Its own evaluation is candid about the trade. On a small sample of real over-eager actions (52 of them), the full classifier let 17% through. On 1,000 synthetic data-exfiltration attempts it let 5.7% through. The point is not that the classifier is bad. It is that any control inside the agent's own loop will miss some things, and you want a second one outside it.

A control that does not depend on the agent#

That is the case for a guardian agent: software that supervises other AI from outside it, and can allow, block, redirect or escalate what it does. For AI on a laptop, three questions come first, and they are the checklist for this week.

1. Which agents are installed? The coding agent a developer installed last week, the local model someone pulled to try, the AI desktop app nobody registered. Most never go through procurement.

2. How freely does each one act? Agents differ in whether they ask before editing files or running commands. Some are set to skip asking. You want that by agent and by machine, not as a policy that says "always ask".

3. What can each one reach? MCP servers give an agent a route into live systems. A provider key sitting in a file gives it a way to spend money or call a service. How much that matters depends on how freely the agent acts.

What EndLayer does, and where it stops#

EndLayer is a guardian agent for AI. One agent, the Layer 1 Agent, runs on each laptop or server without admin rights. It reads 21 signals from the files AI tools leave behind. The ones that bear on this post:

• Tools and agents and Autonomy: which coding agents and AI tools are installed, and whether an agent can act on its own and how far it is pre-approved. That is the Surface module, and it reports every fifteen minutes.
• MCP servers and Credentials: the declared servers, their transport, host and capability, and that a provider key exists, its variable name and whether git ignores it.
• Guardrails in the agent score prompts before they run and warn on, redact or block secrets and personal data on the way out, on the device. The matched text never leaves the machine. Removing an installed app waits for an administrator. That is the Govern module.

Where it stops. EndLayer does not patch web servers, scan for PHP2Shell, or read the PHP version on a server. It cannot see a device it is not installed on. And a guardrail is one control, not a guarantee. Like any control it can miss things, which is why the list above starts with knowing what is there.

Sources#

• PHP2Shell: Wiz Research, Calif and CISA. OpenAI's Patch the Planet post and Cloudflare's account are reported by PPC Land.
• Exploitation timing: Rapid7, Q3 2026 threat update.
• Agent oversight: Stack Overflow, "Agents on a leash".
• Approval fatigue and classifier error rates: Anthropic Engineering, Claude Code auto mode.