AI Has Started Finding Security Flaws: Patch Windows Are Shrinking, What Should Businesses Do?
This week's PHP flaws were an example where AI models were used in discovery and the issue turned into attacks within weeks. How does this affect patch timelines, shared responsibility and business security routines? Without exaggeration, we give a practical patch management plan.
In brief: The PHP2Shell flaws announced this week became a concrete example of a change security circles have been discussing: AI models can speed up finding security flaws and turning them into exploits. According to Wiz, the first finding was made on 19 August and reported to PHP on 24 August; the patch came on 21 October. In Wiz's words, “a single researcher completed in a week what previously would have taken a world-class team months of work.” OpenAI warned that the same capabilities that help defenders could also let attackers build exploits quickly. The takeaway for businesses need not be frightening, but it is clear: the time from a flaw going public to attacks is shrinking, so a “we'll look at patches once a month” model falls short. This article summarises the events in a measured way and gives a practical patch management plan. Information relies on sources published as of 23 October 2026.
Last updated: 23 October 2026
What happened and why does it matter?
PHP2Shell is a pair of critical flaws affecting almost every PHP version. The AI-related points that emerge from the sources:
- Wiz Research wrote that it used AI models to find the flaw, made its first finding on 19 August 2026 and reported it to PHP on 24 August. In Wiz's words, frontier AI models “substantially reduced the barrier” to turning a long-standing flaw into an exploit (Wiz).
- According to ABC News, the US security firm Calif, during a security programme using OpenAI models, used AI to confirm that an attack route proposed by existing research was a real flaw. The bug may stretch back to PHP versions from around 2012 (ABC News).
- The PHP Foundation said AI helped assess reports, but that “a person makes every call and works on every patch.”
- OpenAI warned that the same capabilities that help defenders could speed up attackers producing exploits.
- Details leaked before the official announcement and exploitation attempts were reported in the wild; Amazon said attempts go back to 17 October.
The sources credit different teams with the discovery; what they share is that AI played an active role in the process. The reporting should be kept in proportion: you can't say AI “produces hackers automatically,” but it is evidently speeding up a capable researcher's work noticeably.
What changes for businesses?
1. The gap between “fix released” and “attack starts” is narrowing
In the past, turning a flaw into an exploit needed serious engineering. As AI lowers that barrier, the time between a patch and exploitation may get shorter. Even this week, exploitation attempts were seen before the announcement.
2. Patch management becomes “operations,” not “maintenance”
Within the same week, urgent updates came out for PHP, Node.js and Next.js (Node.js, Next.js). An update flow this frequent can't be managed with a “maintenance twice a year” approach.
3. The defence side is speeding up too
The same capabilities help defenders: flaws can be found earlier and code review can get stronger. So the picture is not one-way deterioration; the risk rises for organisations that can't manage speed.
4. Supplier responsibility must be explicit
If an agency or hosting company manages your site, who will apply urgent patches, and within what time, must be in writing. If the contract doesn't say, the argument happens at the moment of the incident. See our software contract checklist and our maintenance and SLA guide.
A practical patch management plan (for small and medium businesses)
| Step | What is done? | Owner |
|---|---|---|
| 1. Inventory | A list of all sites/applications, servers, runtimes (PHP, Node.js, Python...), CMS and plugins, with versions | Software team/agency |
| 2. Sources to follow | Subscribe to official security announcement channels (PHP, Node.js, Next.js, your CMS) and national cyber security alerts | Technical owner |
| 3. Prioritisation | “Unauthenticated + remote code execution + internet-facing” = urgent; others go in the normal maintenance window | Technical owner |
| 4. Time target | Example: hours to a few days for critical flaws, one week for high, monthly maintenance for the rest. Set the figures to your sector and risk | Management + software team |
| 5. Testing | A quick check of critical flows after the update (login, payment, forms, integrations); ideally automated tests | Software team |
| 6. Rollback plan | Have a backup and a way to roll back | Software team |
| 7. Secret management | A written plan of which keys are rotated, and how, if compromise is suspected | Technical owner |
| 8. Records | Which patch was applied when? Leave a trail for audit and insurance | Software team |
Using AI on the defence side
AI is not only a threat; it is a tool. With care and human oversight it can help in: code review and security scanning support, dependency vulnerability analysis, anomaly detection in logs and test scenario generation. But confidentiality rules are essential when sharing code and data: see our AI use policy for businesses. For the quality and security side of AI assistants in software development, see our AI-assisted development guide.
What not to do
- Panic and shut everything down: Prioritise; identify the affected components.
- Think “I'm a small site, I won't be a target”: Automated scanning and exploitation don't pick targets; they look for every vulnerable internet-facing system.
- Rely on a WAF alone: WAF rules give extra protection; they are not a fix.
- Skip the post-patch check: An upgrade can itself cause errors.
- Stay on old, unsupported versions: Unsupported versions get no patches.
Security-focused maintenance with Aktaş Digital
In web applications, version inventory, urgent patch tracking and post-upgrade testing are part of the maintenance plan. If you'd like your current site's security and maintenance routine reviewed, or to make maintenance and security commitments clear from the start of a new project, you can use our quote form. Related services: web applications and AI solutions.
Frequently Asked Questions
Is AI really finding security flaws?
In this week's PHP incident, both Wiz and the Calif example reported by ABC News say AI models were used in the discovery. The sources also stress that human experts were part of the process.
Are attackers using AI too?
OpenAI's warning is that the same capabilities could speed up exploit development for attackers. This is a warning of possibility; it doesn't mean every attack is carried out with AI.
How long should my patch window be?
There is no single right figure; it depends on risk, sector and regulatory requirements. For critical flaws that are internet-facing, unauthenticated and allow code execution, the window should be on the order of hours to a few days.
What are the three most important steps for small businesses?
- Knowing what is running (inventory), 2) written patch responsibility and time (contract/SLA), 3) a working backup and rollback plan.
Does AI make code less secure?
Code AI produces needs review as well. Code review and security scanning should be applied to the same standard; see our AI-assisted development article for details.
Conclusion
AI can speed up both flaw discovery and exploit development; as a result patch speed becomes a matter of competitiveness and trust. The answer is not fear but a simple routine of inventory, monitoring, priority, time targets and testing. The first thing you can do today: with your software team, write on one page the answer to “when a critical flaw is announced, who does what, and within what time?”
