The Wall Street Journal · 2026-10-23 2026-10-23-w3
AI Just Found a Bug That Puts up to 70% of the World's Websites at Risk
PHP2Shell puts a clock on the week's argument. Ryan Austin used GPT-5.6 Sol to take control of in-memory code in as few as a few dozen requests, in a bug class flagged decades ago and dismissed as too hard to exploit. The roughly ten-week embargo, from the Aug 11 call to the Oct 21 patch, broke on one Hacker News post, and a patch of close to 200 files now works as a blueprint. Finding was cheap for the researcher and the attacker alike; absorbing the fix across the long tail of unpatched servers is the slow part. For internet-facing open source, time-to-deploy is measured in hours, so mitigations have to ship before the diff does.