October 2026 is going down in computer history as Black October. It will be remembered as the moment the tech industry could no longer ignore the impact of AI on cybersecurity. Everyone knew this moment was coming, but it took a vulnerability with an internet-wide blast radius to wake the world up to the fact that it was already here.
The vulnerability is called PHP2Shell and it allowed an attacker to leverage two separate bugs to gain control of server running PHP. PHP has been around since the dawn of the internet and is used to build web services. WordPress is built on top of PHP.
PHP2Shell worked on every version of PHP going back a decade. 69% of websites use PHP. This is why the blast radius was internet-wide and the tech industry when into a panic, with the US National Security Agency recommending that websites go offline if they couldn’t install the security patches immediately. Governmental services took themselves offline until they had patched the flaw.
The open source maintainer in Nebraska
The XKCD comic is the classic summary of the risks and benefits of open source software.
SaaS would not exist as a category without open source software. Most SaaS code is a thin layer of glue between open source projects.
Even if you’re an enterprise with deep pockets, your product’s code is built on open source projects (databases, telemetry, UI frameworks like React, etc) running on an open source stack (like PHP).
The irony is that the vulnerabilities making the headlines in Black October weren’t in the code of the products, they were in the open source projects the products relied on. Even if your developers are using best practices, modern software infrastructure leaves you at the mercy of other people’s errors at the same time as you benefit from their software.
The future of software development
All software has until recently been written by humans, fallible, error-prone humans. Now it is, globally, being written in part by AI. AI-written code is not bug free code. There is a reason vibe-coded projects are referred to as slop.
AI coding ability keeps improving, and techniques for producing reliable software using AI also keep improving.
But there is still a lot of error-ridden code running the services we depend on. There always has been. Issues as critical as PHP2Shell will continue to appear. In response, the industry is embarking on a Y2K style effort to find and eliminate the kind of exploitable errors that lead to Black October.
Find all the bugs
AI is enabling developers to dedicate more resources to testing and verification. AI finds generating tests as easy as generating code. The constraints on testing are now token costs and time instead of developer hours. AI Testing still needs the same supervision that AI coding does, but once tests are written they keep delivering value.
On the open source side, Anthropic is providing OSS Scanner, which offers open-source projects free regular security scans. OSS Scanner grew out of Anthropic’s Project Glasswing, it’s cybersecurity project that used its famously unavailable Mythos model.
OSS Scanner doesn’t fix the problems it finds, but it does use Anthropic’s advanced models to scan open source codebases and report back the issues it finds.
The focus is on open source projects that are part of critical infrastructure or has high usage among users/projects.
OpenAI has a similar program called Codex for Open Source that developers can apply for. It is more general, giving access to the Codex Security tool and credits to use it and OpenAI’s advanced models.
Avoid all the bugs
The best kind of bug is the bug that never happens. Some programming languages make enitre categories of bugs impossible. For example, Rust makes the kind of memory-safety issues that PHP2Shell exploited impossible.
The problem is that writing memory safe code in Rust was more complex than writing code in other languages that did the same work. The time and complexity cost meant Rust wasn’t popular.
Except AI doesn’t care about complexity or how much code it needs to write in order to get it to compile without errors. Converting codebases to Rust (such as pnpm or bun) or choosing Rust over languages like TypeScript, Python, or C for new projects is now an option because of AI.
The deeper level of avoiding bugs is formal verification. In formal verification you build a mathematical model of the code and then use that to prove that the code never violates some set of security constraints you selected.
The challenge is that the proofs are much, much more complicated than even Rust. Your proof code can be many times larger than the code it is modeling and developing those formal verifications is a specialised skill.
For example, it took two person-years to implement the seL4 operating system kernel, but 20 person-years to formally verify it. This is why formal verification has only been used in mission critical applications where the time and expense is worth it, like in Airbus’s avionics code.
Again, AI helps here. It is particularly good at translating the expression of logic in one language, eg Rust code, into another language, eg TLA+, for providing that formal verification.
This is resource intensive. But it is foreseeable that in the near future, to counter the cybersecurity threats of agentic AI, the world’s software will be built on a formally verified core, from operating system to animated gif in the browser.
What do we do until the future arrives?
The industry has in place systems for identifying, communicating and fixing exploits like PHP2Shell, and AI is accelerating that process. Defense is advancing as fast as offense.
However, there will always be vulnerabilities in software, even with AI, because software is complex and so is the world that it interfaces with. Formal verification will eventually eliminate the most dangerous errors, but even with formal verification you can only prove software is free of the bugs you chose to prove. There will always be errors of logic even if there will no longer be memory safety errors.
This is why SoftwareSeni has, and always will have, a 24/7 devops team with automated monitoring of security alerts. We can respond rapidly to critical vulnerabilities that could impact any of our clients’ products or tech stacks.
During Black October this allowed us to keep our clients protected despite the severity of the vulnerabilities being exploited, and the very short window between the vulnerabilities being announced and bad actors taking advantage of them.
If you want to talk cybersecurity, or developing a project with professional monitoring and management on the backend, get in contact and let’s chat.
