PHP2Shell has every vendor shipping urgent fixes this week. The ones I’d watch are the AI systems that keep working after the patch goes in.
This morning, several forums I’m part of filled up with vendor advisories, all saying patch this now.
The underlying cause is PHP2Shell, two critical flaws in PHP, the language behind roughly 70% of the world's websites. Cloudflare is already reporting millions of exploit attempts. Some national cyber agencies are telling site owners to go offline until they’ve patched.
So for a lot of tech leaders, today looks like 5 urgent PRs for production, all needing to go out today. Teams go ‘all hands on deck’ just to get through whatever tests are possible.
For conventional systems, there’s at least a playbook. Check the dependency map, test in staging, sign off, then deploy. It’s never as clean as the diagram, but people know where to look.
AI setups don’t come with that map.
A lot of an AI system’s dependencies live in its prompts and retrieval settings, as assumptions about how upstream systems behave. What a field means. How big an upload can be. That last one ties straight into the suggested PHP mitigations: drop the upload limit to 8MB if your app doesn’t need file uploads. Sensible. But if that app feeds documents to an AI assistant, nobody may have listed upload size as a dependency, because it only ever existed as an assumption in a prompt.
That’s the uncomfortable part. When a conventional integration breaks, someone usually gets an error. An AI system usually just carries on.
When I was building agents at Lexacon, I learnt that the same input doesn’t always give the same output. Conversely, a different input can still give a perfectly plausible output that just isn’t right any more. So ‘it still works’ after a patch proves very little.
Today, this is happening at scale. Five vendors patching in the same week, each one touching AI systems you’ve rolled out, including ones wired into business workflows without you knowing. Every one carrying assumptions no dependency map captures.
At that point it’s as much a governance problem as a security one. The patching decision gets made under pressure by people who can’t see what the AI systems quietly depend on, and what depends on those AI systems.
I don’t think there’s a single fix. What you’d need to check depends entirely on how each AI system is configured. But knowing the problem exists is half the battle.
So before the next round of urgent patches lands: do you know what your AI systems assume about the world they’re plugged into?
#AIGovernance #PHP2Shell #AIRisk
Sources:
PHP2Shell basics and the 8MB upload-limit mitigation: BleepingComputer, https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/
Discovery by Calif and Wiz using AI models, attackers already probing: CyberScoop, https://cyberscoop.com/php-emergency-patches-php2shell-vulnerabilities/
Agencies telling sites to patch or go offline: RTÉ, https://www.rte.ie/news/world/2026/1021/1596231-eu-cybersecurity/
Cloudflare’s millions of exploit attempts: BigGo Finance, https://finance.biggo.com/news/9e041949-ed44-4827-9e7c-99259c4268e3