The short version

On 21 October 2026 the PHP Foundation released emergency patches for two unauthenticated remote code execution flaws, nicknamed PHP2Shell, that affect all versions of PHP ( TechTarget ). Security agencies including the NSA, CISA and the UK's NCSC advised taking unpatched sites offline, and hundreds of government sites in several countries did go dark.

I think this is one of the most useful AI safety case studies of the autumn, and not because an AI went rogue. It did not. It matters because it shows what happens when capable, widely available models speed up one side of a security problem much faster than the other. Below I set out what happened, what I think it shows, and what it should change for programmes like ERA.

What happened

The discovery was fast, and the AI-assisted work was spread across several teams.

Calif , a security firm, began an audit on 30 July through OpenAI's Patch the Planet programme and reported the first flaw to PHP on 11 August.…