Ibrahim AbuAlhaol

Security & SafetyLearning & Cognition

Everyone Has a Flashlight

AI gave everyone, attackers included, the same flashlight. Knowing where to point it is now the advantage.

Ibrahim AbuAlhaol

2 min read

A floor plan of six rooms where faint flashlight beams point in every direction, while one amber point aims a bright beam straight at a glowing target in the top right room.

Imagine everyone suddenly gets a powerful flashlight: you, your neighbours, and the burglar. It lights up whatever you point it at. It does not tell you where to point it. The person who knows the house still knows which room to check first.

That picture came out of a discussion with Salah Abualhoul1 about PHP2Shell, the flaw that led governments to take their own websites offline this month. This is where we landed.

AI was the flashlight

PHP runs 69% of the websites whose server-side language is known,2 and Germany, France and four other countries took sites offline over this flaw.3 The headlines said AI found it. The researcher who reported it first did use a public model, but what aimed it was his twenty years of knowing where PHP's bugs hide. He writes that no model finds "all bugs" with simple prompts.4

Once he had pointed the way, others arrived fast. Another team found the same flaws within weeks,5 and someone tried the attack four days before it was announced.6 A flashlight is not an advantage when everyone has one, and the burglar has the same one you do. The advantage is knowing the house.

The noise nobody checked

The uncomfortable part is that this noise was heard before. The problem came up in a 2024 audit and was left because nobody could prove it was exploitable.4 The PHP Foundation now calls that a structural failure.7

The rule was not foolish. "No proof, no fix" made sense when proving it took an expert team months; nobody wakes the whole house for every creak. But this year the proof took one person about two weeks. When checking is that cheap for you, it is that cheap for the burglar. The rule has to flip: if you hear a noise near an open door, act as if someone is already inside.

The same finding in 2024 and 2026 In both years the PHP team followed the same rule: act once there is proof of an exploit. In 2024 proof would have taken an expert team months, no concrete attack path was found, and the issue waited two more years. In 2026 one researcher with an AI model produced proof in about two weeks, the fix became the top priority, and it shipped on October 21, four days after the first known attack attempt. Same finding, same rule, different cost of proof 2024 AUDIT 2026 PATCH THE PLANET THE FINDING out-of-memory issue seen during an audit same root cause reported Aug 11 COST OF PROOF a world-class team, months of work about two weeks one researcher with AI THE HUMAN CALL no concrete vectors, so it can wait proven exploitable, top priority WHAT FOLLOWED parked for two more years patched Oct 21 first attack attempt Oct 17 Amber: the human call, made by the same rule both times. Blue: what AI changed.
Figure 1. The finding did not change between 2024 and 2026, and neither did the rule: act once there is proof. What changed was the cost of proof, from months for an expert team to about two weeks for one researcher with AI. When proof is that cheap, waiting for it hands the first move to whoever proves it next. Sources: [4], [5], [6], [7].

Who walks, and who decides

Let AI agents do the walking: check every room, every server, every copy of the same mistake. Keep people on two decisions: which room matters, and what to do about it now. And write down what your experts know about the house, so the agents walk where they would.

Most teams are buying brighter flashlights. Fewer are investing in the people who know where to point them, or giving those people the authority to act before the proof arrives.

AI sets the pace. People set the direction.

What leaders should do

  1. Retire "wait for proof." If a weakness is plausible and exposed to the internet, fix it in days.
  2. Get your experts' knowledge of the house onto paper, so agents can search the way they would.
  3. Name who can approve an emergency fix before you need one, and measure decisions in hours.

Written by

Ibrahim AbuAlhaol, PhD, P.Eng., SMIEEE

AI Technical Lead at Dell Technologies, working on agentic AI, intelligent edge systems and AI security.

LinkedIn X

References

  1. Abualhoul, S. (2026, October). Personal conversation with the author. LinkedIn profile: https://www.linkedin.com/in/salah-abualhoul/ ↩
  2. W3Techs. (2026). "Usage Statistics and Market Share of PHP for Websites." W3Techs. Accessed October 26, 2026. https://w3techs.com/technologies/details/pl-php ↩
  3. Farooq, U., & Reuters. (2026, October 22). "World leaders warn of security flaws found in PHP programming language." Al Jazeera. https://www.aljazeera.com/news/2026/10/22/world-leaders-warn-against-security-flaw-found-in-php-computer-programming ↩
  4. Austin, R. (2026, October 21). "PHP2Shell." Calif. https://calif.io/php2shell/ ↩
  5. Tzadik, S., Tamari, S., Ohfeld, N., et al. (2026, October 21). "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet." Wiz Research. https://www.wiz.io/blog/php2shell-php-rce ↩
  6. Moses, C. J. (2026, October 21). "Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot." AWS Security Blog. https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/ ↩
  7. The PHP Foundation. (2026, October 21). "Today's PHP Security Release, and How We're Strengthening PHP Security." The PHP Foundation Blog. https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ ↩

  • Learning & Cognition

    The Taste Gap

    Why discernment becomes the human moat once AI makes generation free.

  • Security & Safety

    Agents Are the Attack Surface

    The fastest-growing AI security risk is not the model. It is the plumbing that gives agents their keys.

  • Architecture

    The Harness Advantage

    Why the deterministic scaffolding around a model, not the model itself, is the real differentiator.