The Shrinking Exploit Window: How AI Speeds Up the Hunt for Old Bugs

Contributors: Kithu Shajil, Sergey Novikov, Deepak Nayak

Introduction

Starting the week of October 13, 2026, our threat research and security operations teams spent days developing hunts and exposure checks across multiple severe disclosures: PHP2Shell, Node2Shell, an actively exploited Windows Shell zero-day, a critical Java certificate trust flaw, and a compromised LiteLLM pipeline release.

Four of the five incidents (PHP and Node updates, the Oracle Java alert, and the poisoned LiteLLM 1.107.0 release) converged on 21 October. The Windows Shell zero-day on 13 October saw active in-the-wild exploitation prior to release, while Next.js shipped an out-of-band security fix on 14 October. PHP2Shell progressed to confirmed remote code execution by 24 October and was added to the CISA KEV catalog on 26 October.

Figure 1: Timeline of the incidents.

While these issues spanned distinct vendors and bug classes, two foundational questions apply to all of them: How long had the flaw remained dormant in the code, and how rapidly did it become dangerous once an attacker or researcher began probing?

In this blog we’ll analyze how these five critical incidents revealed an urgent shift in enterprise risk and how the window between public disclosure and weaponized exploitation has effectively collapsed.

When Unexploitable Becomes Weaponized

PHP2Shell comprises two critical vulnerabilities in PHP—CVE-2026-109618 and CVE-2026-109619 (both rated CVSS 9.2)—which were addressed on 21 October in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The underlying vulnerable code path spans at least 14 years, tracing back to PHP 5.4. The root cause was not entirely undiscovered; a limited variant surfaced during a 2024 audit, but because researchers could not demonstrate a reliable, weaponizable attack path, the finding was deemed low-priority.

That dynamic shifted once security researchers introduced modern AI tooling into the audit cycle. Security firm Calif initiated an automated audit of the PHP codebase on 30 July using OpenAI’s GPT-5.6 Sol, recording its initial discovery on 1 August. Concurrently, Wiz uncovered the flaws starting 19 August utilizing Gemini 4 Argon, GPT-5.6 Sol, and its proprietary Atlas framework. Wiz observed that large language models primarily eliminated manual toil by adapting and synthesizing exploit primitives across disparate PHP branches, server architectures, and heap memory structures. Human researchers maintained control over targeting and validation. OpenAI has indicated that AI-assisted vulnerability discovery will expand substantially across enterprise software ecosystems.

The attack surface continues to evolve. Just two days post-patch, PHP maintainers disclosed a third vulnerability (CVE-2026-115560) residing within the identical session upload progress functionality. As of 24 October, mitigation guidelines exist without an upstream patch, requiring specific edge-case configurations to trigger. Wiz researchers have cautioned that adjacent variations of this design flaw likely remain undiscovered.

The primary takeaway is clear: “No known attack path” simply meant no actor had dedicated sufficient economic or computational resources to engineer one. Modern AI has lowered that barrier to entry.

The Expanding Patch Gap

PHP2Shell technical details leaked on 20 October, 24 hours prior to coordinated patch distribution. Almost immediately, Cloudflare registered scanning activity targeting customer endpoints, while watchTowr captured exploit attempts within distributed honeypots on release day. Huntress reported negligible initial impact within its monitored footprint during that initial window. Amazon telemetry captured initial probe activity as early as 17 October—four days prior to the official fix—though early attempts were largely malformed.

The transition to reliable weaponization was swift: on 24 October, honeypots maintained by a Perplexity researcher documented 35 interactive, working shells executing from two source IP addresses. On 26 October, CISA incorporated both CVEs into its Known Exploited Vulnerabilities (KEV) catalog, mandating remediation across federal systems by 29 October. (Note: The honeypot validation leveraged a favorable, single-worker process model, which may not directly reflect reliability across multi-tenant enterprise architectures).

Figure 2: The patch gap as two parallel lanes.

Node2Shell exemplifies this compressed exposure cycle. The upstream fix for an underlying Brotli compression flaw (CVE-2026-111497) was merged into the open-source tree in February. However, the Node.js project did not release a patched build until 21 October. Within 24 hours (22 October), a public proof-of-concept exploit was released. While full code execution initially required relaxed build flags—and exhibited inconsistent results against stock Node 24.22.0 deployments across varied platforms—the exposure profile remains significant: eight months of public patch latency followed by weaponization within a single day.

The Next.js disclosure exhibited equivalent operational friction through standard dependency chains. The underlying SVG issue (CVE-2026-96889) involved a use-after-free bug in librsvg, surfaced via the popular sharp dependency. While disclosed on 23 September and patched downstream in sharp on 27 September, Next.js did not distribute remediated versions (16.4.1 and 15.5.28) until an out-of-band advisory on 14 October—a 21-day latency window. Furthermore, that release addressed a separate, unauthenticated RCE condition within Cache Components triggered when cached functions emit multiple typed arrays. Because this internal logic flaw lacked a dedicated CVE assignment, automated scanners relying solely on CVE databases failed to detect exposed deployments.

Similarly, the Windows Shell flaw (CVE-2026-96951)—the third actively abused Windows Shell vulnerability identified this year—was already being leveraged by threat actors prior to its 13 October patch. Microsoft credited an external researcher who utilized Claude during their discovery process. This follows a June pattern where a Mark of the Web (MotW) bypass analysis credited AI models with reversing binary patch diffs within 24 hours of release. The reality is simple: patches serve as an architectural roadmap for adversaries, and parsing those differences is faster and cheaper than ever.

Industry metrics reinforce this shift:

• The Zero-Day Clock initiative tracks the average duration from public vulnerability disclosure to active exploit delivery, which dropped from 771 days in 2018 to roughly 24 hours by mid-2026. By July 2026, the project’s mean time became negative (-8 hours), indicating active exploit weaponization often occurs ahead of public advisories.
• The 2026 Verizon Data Breach Investigations Report (DBIR) indicates that the median organizational timeline to patch known exploited vulnerabilities has lengthened to 43 days (up from 32 days), with full patch saturation declining to 26% (down from 38%).
• Remediation backlogs are compounding under higher volume: Cisco Talos cataloged 622 Microsoft vulnerability advisories in July, 421 in August, 973 in September, and 1,415 in October.

The Limitations of AI in Recent Incidents

While AI has altered the speed of vulnerability analysis, it is equally important to contextualize what modern AI did not influence across recent security incidents:

1. The Java/eMudhra Trust Degradation (CVE-2026-91403): This issue originated from cryptographic weakness rather than automated reverse engineering. Eight intermediate Certificate Authority (CA) keys generated by eMudhra in April 2025 possessed insufficient entropy, allowing potential brute-force deduction within 256 attempts. These weak keys sat latent in public infrastructure for 17 months. While major browsers revoked the roots within hours of the 17 October report and Oracle issued an out-of-band alert on 21 October, eMudhra reported no rogue intermediate certificates were issued. Crucially, systems patched with the standard 20 October Oracle Critical Patch Update (CPU) remained vulnerable until the subsequent out-of-band alert was applied.
2. The LiteLLM Supply Chain Hijack: The distribution of malicious package version 1.107.0 on PyPI occurred through conventional credential compromise rather than AI manipulation. The package was live for 1 hour 44 minutes on PyPI and 2 hours 30 minutes across public container registries before revocation. Forensic assessments trace the initial compromise to an exposed secret inadvertently committed to a public repository in May, leading to the theft of maintainer tokens on 10 October and subsequent release-pipeline poisoning. Wiz observed actors validating stolen cloud credentials and surveying Amazon Bedrock environments within four hours of host egress. The incident emphasizes that centralized AI orchestrators, API gateways, and model routers are high-value targets due to the broad access credentials they aggregate.
3. Autonomous Offensive Frameworks Remain Unproven: Autonomous, end-to-end cyberattacks driven solely by AI agents have not materialized in practice. Palo Alto Networks Unit 42 analyzed a threat actor utilizing DeepSeek via custom agentic loops, concluding that autonomous exploitation attempts failed to achieve compromise without manual human intervention and operator guidance.
4. Post-Exploitation AI Remains Rare: While early claims linked an intrusion at a European government agency to PHP2Shell, Unit 42 subsequently retracted the attribution due to insufficient evidence tying the initial foothold to CVE-2026-109618 or CVE-2026-109619. Public telemetry shows that initial exploitation cycles continue to lean heavily on conventional attack paths: mass scanners, commodity Mirai variants, and automated shell drops.

Fighting Speed with Speed: Automated Blast Radius Scoping

If offensive actors are compressing the gap between patch availability and functional exploitation to hours, defensive operations cannot afford triage cycles measured in days. Security teams cannot wait a week to determine which endpoints are vulnerable, whether an exposed service was touched, or what assets remain uninventoried.

To address this challenge during last week’s disclosure wave, we deployed our internal threat hunting agent across our enterprise telemetry. For each distinct advisory, the agent parsed technical vulnerability parameters, synthesized hunting logic across our telemetry stack, executed multi-stage queries, and correlated results into actionable triage summaries:

The primary value of autonomous threat hunting lies in the structural clarity of the output. In under 30 minutes of cumulative execution, the agent scoped our operational exposure: pinpointing obsolete runtimes, mapping perimeter visibility, surfacing unassigned IT assets, and checking for known post-exploitation behaviors.

Figure 3: Threat hunting agent execution summary for Java CVE-2026-91403 (KQL, Microsoft Defender).

Telemetry sweep processed 10 rules in 7 minutes and 8 seconds, identifying 4 vulnerable internal endpoints. Critical finding highlights an unassigned, high-exposure device requiring prioritized remediation.

Figure 4: Threat hunting agent execution summary for PHP runtime exposure checks (KQL, Microsoft Defender).

9 queries were executed across fleet telemetry in 7 minutes and 14 seconds. The report verifies clean internal telemetry while recommending asset validation across public-facing perimeter proxies.

Figure 5: Threat hunting agent execution summary for Node2Shell (KQL, Microsoft Defender).

Over 10 queries executed in 9 minutes and 1 second, the agent identified 5 outdated Node.js installations and flagged anomalous off-hours script execution on a macOS developer host for analyst review.

Figure 6: Threat hunting agent execution summary for PHP2Shell exploitation attempts (Splunk SPL).

12 queries completed in 5 minutes and 55 seconds. Findings isolated anomalous HTTP POST probes against a financial application host, validating all attempts were blocked at the edge.

Operational Constraints & Analyst Governance

Automated hunting agents accelerate analysis, but their technical boundaries require disciplined operational oversight:

• Absence of Evidence is Not Evidence of Absence: “No threat activity identified” applies solely to the endpoints, log sources, and retention windows visible to the agent. Uninstrumented web gateways, perimeter edge devices, and disconnected clouds require manual auditing.
• Temporal Limitations: Scans executed prior to widespread weaponization reflect only a snapshot in time. Our early PHP2Shell sweeps were run on 21 October, three days prior to confirmed wild exploitation on 24 October. Continuous, recurring sweeps are mandatory.
• Mandatory Human Validation: AI models excel at correlation but cannot assume contextual intent. The off-hours Node script identified on the macOS workstation required a human analyst to verify legitimate developer operations.
• Telemetry Verification Over UI Statuses: Discrepancies can occur between high-level summary UI chips and raw telemetry outputs (such as a run indicating “Clean” alongside an unmitigated “High Severity” software finding). Security teams must treat parsed event logs and raw query matches as the authoritative source of truth.

Defensive Directives for Security Leaders

To counteract faster exploitation cycles, organizations should refine their vulnerability management workflows:

1. Retire “No Known Exploit” as a Risk Metric: Do not defer patching on internet-facing services simply because a public proof-of-concept is not yet available. Prioritize external endpoints handling untrusted input (e.g., PHP request pipelines, Brotli parsers, and custom TLS handlers).
2. Catalog Hidden and Nested Runtimes: Maintain visibility beyond primary operating system packages. Track embedded Java runtimes packaged in enterprise apps, Node binaries inside build containers, legacy PHP dependencies inside virtual appliances, and nested npm components like librsvg and Next.js. Account for unmaintained versions: Node 20, 23, and 25, along with PHP 8.1 and earlier, will not receive security backports.
3. Hunt Behavioral Telemetry Over Static Identifiers: Rather than scanning solely for static CVE numbers or brittle file hashes, configure detection engineering around behavioral anomalies: web daemons spawning child shells, sudden reconnaissance command sequences, or binaries dropping into /tmp.
4. Recognize Patching as Step One: Restart web worker pools to flush stale libraries from memory, rebuild base container layers with pinned dependencies, and rotate system secrets that were exposed during the compromise window. For vulnerabilities lacking a formal patch (such as CVE-2026-115560), implement interim hardening rules immediately.
5. Establish Mitigation SLAs in Hours: For internet-facing assets, measure mitigation windows in hours, not weeks. Deploy web application firewall (WAF) virtual patches, temporary ingress blocks, or container isolation immediately while formal updates undergo validation.

Indicators of Compromise (IoCs)

Within 48 hours of PHP2Shell’s public patch, malicious infrastructure began distributing Potassium, an aggressive Mirai-derived DDoS botnet. While vendors like Sophos confirmed active delivery payloads were blocked by edge defenses, compromised instances risk recruitment into coordinated DDoS botnets and secondary malware loaders.

Note: All network artifacts and identifiers below have been defanged. Verify both hackattackkaboom and common variants during threat hunting.

Telemetry Investigation & Triage Guidance

• Audit Historical Network Telemetry: Query passive DNS, proxy logs, and perimeter firewalls for outbound requests to godofthunder[.]st back to 12 October 2026 (its initial registration date).
• Prioritize Behavioral Sequences Over Hashes: Static file hashes are easily modified by adversaries recompiling Mirai sources. Monitor instead for post-exploitation behaviors: web workers (php-fpm, apache2, nginx) spawning processes like curl, wget, or /bin/sh to download files into /tmp, followed by permission changes via chmod.
• Distinguish Anonymized Scanners from Dedicated Infrastructure: Exercise caution when executing IP-level network blocks. Public scanning addresses (103.216.220[.]92, 31.223.184[.]166, 37.19.200[.]5, 134.209.159[.]64, 103.114.163[.]188, and 95.217.98[.]37) frequently operate via shared Tor exit nodes or commercial VPN nodes. Furthermore, research scan agents such as php2shell-verify/1.0 (originating from 91.90.123[.]25) represent benign academic measurements rather than active adversary infrastructure.

Reference Sources

• Wiz Research: PHP2Shell Analysis & AI-Assisted Discovery
• Palo Alto Networks Unit 42: Threat Brief: PHP2Shell Exploitation Dynamics
• Palo Alto Networks Unit 42: Evaluating Offensive LLM Frameworks and Autonomous Operations
• OpenAI / Gizmodo: Patch the Planet Program Report
• Decrypt: The AI-Driven Discovery of PHP2Shell
• Trending Topics: PHP Architecture Audits and Historical Context
• watchTowr: PHP2Shell Honeypot Detection Analysis
• Huntress: Rapid Response: PHP2Shell In-The-Wild Probes
• PPC Land: Cloudflare Edge Telemetry on Automated Exploitation
• Penligent: CVE-2026-115560 Technical Overview
• Aikido Security: Node2Shell and Brotli Dependency Timeline
• SOC Prime: Detection Rule Briefing: Windows Shell Zero-Day (CVE-2026-96951)
• Help Net Security: Modern Windows Shell Exploitation Trends
• Public Analysis: CVE-2026-45595 Mark-of-the-Web Bypass and AI Binary Diffing
• Cyber Kendra: CVE-2026-91403 and Weak Intermediate CA Keys
• Scott Helme: Eight Bits of Trust: Cryptographic Flaws in Public PKI
• Mozilla Bugzilla: Incident 2083449 Root CA Revocation
• LiteLLM Security Advisory: PyPI Package Tampering and Pipeline Post-Mortem
• Datadog Security Labs: Analyzing the LiteLLM Supply Chain Incident
• Cisco Talos: October 2026 Vulnerability and Patch Volume Analysis
• Zero-Day Clock Project: Exploit Window Velocity Report (2018–2026)
• Verizon: 2026 Data Breach Investigations Report (DBIR)
• CISA: Known Exploited Vulnerabilities Catalog Updates (October 2026)
• SecurityWeek: Tracking PHP2Shell from Scanning Probes to Active Shells
• Sophos X-Ops: Potassium Botnet Exploitation Analysis
• Next.js Security Advisory: Cache Components and SVG Handling Patches (v16.4.1 / v15.5.28)