Amazon saw an exploitation attempt on October 17 — four days before disclosure — and PHP shipped the patch on October 21.
Fast discovery, faster exploitation
Researchers at Calif and Wiz found two remote code execution flaws in PHP in August, with help from OpenAI and Google models, and disclosed them jointly with OpenAI. The two flaws had existed in PHP’s code since 2012 and affect “the language behind 69% of the web.” Attack activity escalated rapidly: watchTowr observed exploitation attempts the same day PHP released the patch, Cloudflare reported rising attack traffic after disclosure, and on October 26 CISA added both flaws to its list of known exploited vulnerabilities.
Scale and exposure: millions of potentially vulnerable services
Remediating PHP2Shell will be unusually difficult because PHP ships inside appliances and hosting control panels that customers can’t patch themselves, and “versions 8.1 and older got no official builds.” As of October 27, Censys counted 32.5 million internet-facing PHP services still running potentially vulnerable versions, and more than 60 million other services that don’t report a version at all — a large surface for attackers moving fast.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadRemediation speed lags exploitation tempo
Even when defenders move quickly, they are racing a widening gap. Verizon’s 2026 DBIR states the median time-to-fix of a known exploited vulnerability is 43 days; Qualys reports a mean remediation time of 21.2 days and that 63% of critical vulnerabilities are still open after a week. Those delays matter when roughly 195 new CVEs are published every day and attackers are often probing before disclosure.
Why blast radius matters more than CVSS
Finding a vulnerability is only the start. The article’s central point: “vulnerabilities lead to exploits, and exploits lead to attacks, but in an enterprise context, the impact of an attack is determined by how far the compromised identities can reach.” A shell on a PHP server grants an attacker access to whatever that server can read — “from environment variables to cloud keys in config files.” PHP2Shell can also leak worker memory, including passwords, tokens, and API keys. As the piece puts it, “an attacker executing code on one host opens a door to a hallway, but the real valuables are usually in locked rooms.”
LiteLLM as a live example of identity-based escalation
October’s other headlines provide a concrete example of how exposed credentials expand blast radius. At LiteLLM, attackers used a master key exposed in a public repository to retrieve an unscoped GitHub organization-owner token from an internal agent platform. That identity allowed them to steal two more maintainer tokens, subvert the release workflow, and publish credential-stealing artifacts. The sequence illustrates the article’s argument: attackers take the easiest path, and a leaked credential plus identity access often beats stitching together multiple technical exploits.
What this means for security teams, procurement leaders, and regulators
- Security teams: Inventory every AI agent and non-human identity, assign an owner, scope access to purpose and intent, remove dormant credentials, and continuously govern the identity lifecycle. For AI agents, the article urges granting access “by intent” and treating identity as the control plane.
- Procurement and enterprise leadership: Expect application-security vendors to make a strong business case off PHP2Shell — find more bugs, fix faster — but the piece recommends balancing vulnerability discovery with concrete limits on what compromised workloads can access.
- Regulators and defenders: The rapid addition of these flaws to CISA’s known exploited vulnerabilities list on October 26 underscores how quickly exploited vulnerabilities draw official attention once active abuse is observed.
Patching determines how fast you close a hole; identity determines how much an attacker gets when you can’t. Given the speed of modern exploitation and the scale of unpatchable or hard-to-patch deployments, the article argues the measurable, finite task of shrinking blast radius — by inventorying and scoping identities, removing dormant credentials, and enforcing intent-based access — is the tactical leverage enterprises should prioritize even as they accelerate vulnerability discovery and patching.
