Joe Pantuso

The arms race just sped up

November 5, 2026

tl;dr AI is finding and weaponizing old bugs faster than most people can patch them, PHP was the big one this fall, and it’s time everyone wakes up to the new reality.

Computers have always hosted an immune system fighting an infection. Every defense breeds a better attack, every attack breeds a better defense, and the two never stop. What’s new this year is the speed it is unfolding at.

I’ve said before that AI amplifies things that were already true. This is one of them. AI is helping attackers find and use holes faster than ever, and it’s helping defenders find and fix them faster than ever. Both at once. I’ve been calling the entire phenomenon of AI accelerated everything the renaissanceapocalypse. The same tools that feel like magic are the ones making everything more dangerous, and they arrived together. Security is where you can see it most clearly, and the numbers from 2026 are eye opening and eye watering.

The numbers

Google’s threat intelligence group counted vulnerability disclosures per month doubling this year, from 5,045 in January to 10,740 in August. Actual exploitation in the wild went from about 10 a month in 2025 to about 18 a month this year. And the finding I keep coming back to is that AI-assisted discovery turns up proportionally more of the serious stuff, namely the bugs that lead to remote code execution and takeover.

Microsoft is the clearest picture of the defense side, because they put out a batch of fixes on ‘patch tuesday’ every month.

Vulnerabilities fixed on Microsoft’s Patch Tuesday in 2026, by month: May 137, June 206, July 622, August 419, September 974, October 1,411. October alone is above the roughly 1,100 fixed in all of 2025.

October alone was more than Microsoft patched in all of 2025.

I considered myself a Windows developer for most of my career, from about Windows 3.11 to Windows 8, I was building stuff on it and for it every day. I was good at it, MS tried to hire me, and I spent time in Redmond professionally. I don’t run Windows for any of my stuff anymore. I got it out of my life as much as I possibly could years ago.

PHP, and therefore WordPress

On October 21st the PHP project shipped an emergency fix for two critical bugs in PHP itself (CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell). Not in WordPress or any plugin. In the language.

Someone on the internet, with no login, can run their own code on your server, or read chunks of the server’s memory that contain passwords, tokens, and API keys belonging to other visitors. Wiz Research, who found them, showed working attacks against the stock WordPress, Drupal, and Joomla installs. Every PHP version going back to 5.4 is hit by at least one of them. That’s more than a decade of releases and a huge chunk of the public facing internet.

The flaws had been sitting in the code for over ten years. What changed is that building a working exploit used to take a chain of steps at the edge of what a human researcher could practically do, and frontier AI models collapsed that to hours. In Wiz’s words, “complexity may no longer provide a meaningful barrier.”

Amazon saw exploit attempts in its honeypots four days before public disclosure. Government websites in Europe went dark. National cyber agencies in the US, UK, and EU told people to patch or take their sites offline until they could, and WordPress.org passed on the UK’s advice word for word, that “organisations should consider taking the system offline.” When was the last time you heard that about a programming language?

And this came three months after a separate, actively exploited, no-login remote code execution bug in WordPress core itself (wp2shell, in July), plus the usual steady drip of plugin holes affecting millions of sites at a time.

Credit where it’s due. The PHP team, the WordPress folks, and the hosting and CDN companies did a lot of fast, coordinated work, and many hosts had firewall rules in place before most site owners heard about it. The response was good. The exposure was the problem.

Why I never let it in

I decided almost 30 years ago never to allow PHP into my systems. I didn’t trust its design or how it was being developed. That later extended to WordPress. I liked the concept, I even ran it myself for a couple years, but… I’ve been telling people for about a decade not to use WordPress, and wherever possible to use a static site generator instead. That’s what I do. This site is built by a small generator I wrote. It turns text files into plain HTML, and the server’s only job is handing out files.

WordPress has lots of great things about it. It’s popular for good reasons. Anyone can edit a page in a browser, there’s a plugin for everything, and a huge number of people know how to set one up. Those are also exactly the problem. Every plugin is somebody else’s code running on your server with your permissions, every login page is a door, and underneath all of it is a language runtime that, as of this fall, could be talked into running a stranger’s code. If it was my project I would have set about rewriting it in a different way a long time ago.

A static site has a tiny surface by comparison. No database to inject into. No admin login to guess. No language interpreter running on each request. Nothing on the server that does anything clever. The tradeoff is real (no editing in a browser, comments and forms need another service or some work), and for most small business sites it’s an easy trade.

Avoiding Windows and PHP doesn’t make anyone immune. Linux and macOS get their share, and the Linux kernel alone racked up thousands of CVEs this year (I used to let Linux boxes go for months between updates, now my fleet gets updated daily). But surface area is the thing you control. The fewer doors, the fewer locks to keep up with.

What to do right now

For businesses:

For individuals:

Will it settle down?

I hope the apocalypse half of the renaissanceapocalypse is the transient part. I think it probably is, at least partly. A lot of what AI is finding right now is old. Decades of bugs that were always there and just too much work for a human to dig out. That backlog is finite. Once the tools have been through the big shared codebases a few times, and once new code gets checked by the same tools before it ships, the flood should drop back toward a stream. I suspect defense has the long-run advantage, since the defender gets to run the same tool on the code before it ships.

But I wouldn’t plan around it settling soon. For now the gap between “bug announced” and “bug exploited” is days, the volume is the highest it’s ever been, and complexity isn’t protecting anybody. Just knowing that an exploit exists is enough now, because it tells an attacker where to point the tools.

If you need help protecting and hardening your stuff, whether that’s moving a business site off WordPress to something static, figuring out what you actually have exposed, or just a second opinion, I might be able to help. Email me, and see Services for the rest of what I do.

Sources