Brian Reed: Hey — before we get into anything, how are you holding up with this one? Because it's a lot.
Eliza Ward: Honestly, still processing. The scale of it keeps — I mean, every time I think I've got it, another number lands.
Brian Reed: Let me start with the part that grounded it for me. PHP2Shell — that's the name researchers gave two specific CVEs. 109618 and 109619. Disclosed October 23rd. CVSS 9.2 each.
Eliza Ward: Unauthenticated remote code execution. Meaning anyone on the internet, no credentials, no inside access needed.
Brian Reed: Right. And the reason the scale is hard to hold — PHP is not an app. It's closer to a shared utility. About 70% of websites run on it. WordPress, Drupal, Joomla, MediaWiki.
Eliza Ward: And watchTowr confirmed it affects every PHP version since 5.4. Which shipped in 2004.
Brian Reed: So this isn't — hang on, let me get this right — it's not 'a bug in some software.' It's a crack in infrastructure that's been sitting there, potentially exploitable, for twenty-two years.
Eliza Ward: Which is why October 23rd has the FBI PSA and CISA's emergency guidance landing the same day. That's not routine disclosure cadence.
Brian Reed: But here's what I keep getting stuck on — that same-day response from the FBI, from CISA, that's the part everyone's calling the headline. 'AI finds catastrophic vulnerability.' Except that's actually the part that worked.
Eliza Ward: That's — yeah. That's exactly the reframe.
Brian Reed: Wiz Research runs AI-assisted analysis, finds both CVEs — 109618 and 109619 — fast. Faster than any human audit would have. So the detection infrastructure worked. Then what?
Eliza Ward: Then it hits the PHP Foundation, which has to coordinate disclosure across — I mean, how many downstream systems are we talking? WordPress alone is a massive surface. And that coordination moves at human speed. Committee speed. The AI handed off to a process that wasn't built for AI-speed discovery.
Brian Reed: And The Verge reported exploitation attempts were already happening before the patch even dropped.
Eliza Ward: Right — and Elizabeth Barron, PHP Foundation executive director, said no confirmed successful RCE as of patch release. So hold on, those two things don't actually contradict each other, but they don't resolve cleanly either. Attempts before the patch, no confirmed successful execution at patch release — that gap is exactly where the disclosure coordination was supposed to hold.
Brian Reed: So the process failure isn't 'we didn't find it fast enough.' It's — the gap between AI-speed discovery and the institutional machinery that has to carry it forward. That's where it became an emergency rather than a managed fix.
Eliza Ward: And 'managed fix' assumes you can actually deploy at scale quickly. 99.3% of instances were still unpatched 24 hours after release. That's not negligence — that's the actual ceiling of how fast remediation moves across 2.2 million exposed instances.
Brian Reed: So the headline 'AI catches catastrophic bug' is — what, half right? Detection modernized. Remediation didn't.
Eliza Ward: Half right — but the part that isn't right is actually doing damage. Because 'Black October.' That phrase is in CNBC, it's in The Washington Post. And I keep looking for it in the CISA guidance, the FBI PSA, the PHP Foundation's own statements. It's not there.
Brian Reed: Yeah, and 'dozens of attacks in two days' — same thing. Where is that sourced? I can't find it attributed to CISA, to the FBI, to watchTowr. It's just... circulating.
Eliza Ward: Does it actually matter if the framing is slightly inflated?
Brian Reed: It matters a lot, actually — wait, let me get this right. If your risk assessment is built on 'dozens of confirmed attacks,' you're calibrating your response to a number nobody verified. And then when the real post-mortem comes, you learn the wrong lesson about what coordinated disclosure is supposed to deliver.
Eliza Ward: Quest Diagnostics.
Brian Reed: Right — October 23rd, same day as the FBI PSA. They disclosed a cyberattack and a data breach. And I mean, look, that's real. But no confirmed link to PHP2Shell has been established. Zero. And yet it's landing in the same news cycle, same headlines, and — I don't think it's intentional, but the proximity does work on people.
Eliza Ward: And Mudd — the IT worker the BBC quoted, working until 22:30 BST to secure customers' systems — that's a real person and a real cost. That part doesn't need inflation. The pressure was real without the exaggeration.
Brian Reed: Which is exactly why conflating it matters. Because the 99.3% unpatched rate and the slower-than-expected exploitation — those two numbers together tell a different, more precise story about what the actual threat window was. And we'll get into that.
Eliza Ward: And those two numbers together — the 99.3% and the slower exploitation — they're actually the thing that makes me want to ask: what was CrowdStrike seeing? Because they put out an assessment on weaponizing PHP2Shell specifically. Not 'this is scary,' but 'here are the constraints and obstacles.' Meaning even for sophisticated actors, this wasn't a press-a-button exploit.
Brian Reed: So does that mean the CVSS 9.2 is overstating it in practice?
Eliza Ward: Honestly — we don't know yet. That's the honest answer. CVSS scores rate the vulnerability as written. They don't rate how hard it is to actually weaponize in the wild. Those are different questions.
Brian Reed: Right, but — okay, so the gap between 'technically exploitable' and 'actively weaponized at scale' — that's exactly the gap where a WordPress site owner in, I don't know, a regional bakery chain is sitting right now. They're not thinking about CVSS. They saw the FBI PSA at 3 a.m. October 23rd and their actual question is: do I have someone I can call?
Eliza Ward: And the answer for most of them is no. That's not carelessness — that's structural. One person managing a WordPress site has zero surge capacity. The patch exists. Deploying it means testing it, making sure it doesn't break their stack, scheduling downtime. That's a week of work compressed into a window that security teams are measuring in hours.
Brian Reed: Which is — wait, so that's actually why the 14,151 number is so clarifying. Out of 2.2 million exposed instances, that's who moved in 24 hours. Not negligent organizations. Organizations that had a security team, had a tested deployment pipeline, had someone awake.
Eliza Ward: Exactly — and that's maybe 0.7% of the surface. The other 99.3% aren't behind. They're just... the actual internet. The 1.3 million potentially affected hosts watchTowr flagged — that's not a list of bad actors. It's a list of normal organizations running normal operations.
Brian Reed: So what do we actually watch from here? Because if attackers were still building tools during that window — and that's me guessing, we don't know — the question is whether exploitation accelerates as those 2.2 million instances stay exposed.
Eliza Ward: The concrete thing: the patch rate over the next seven days. If it stays below, say, 10% — and CrowdStrike's weaponization constraints don't hold indefinitely — that's when the slower-than-expected exploitation stops being reassuring. The mismatch isn't going away. Detection moved at AI speed. Remediation is still moving at Mudd-working-until-22:30 speed.
Brian Reed: The open question for me — and I don't think we can close it — is whether the industry actually changes anything after this. Like, Wiz Research finds PHP2Shell using AI in days. The PHP Foundation patches. The FBI PSA goes out October 23rd. And 99.3% of instances are still exposed a day later. So what's the actual lever? Because if the answer is 'faster disclosure coordination,' that doesn't solve the remediation ceiling. And if the answer is automatic patching at infrastructure scale — I mean, that's a different internet than the one we have.
Eliza Ward: Wait — and Elizabeth Barron's 'no confirmed successful RCE as of patch release.' 'Confirmed' is still doing a lot of work there. We may know more in days. That word might flip.
Brian Reed: Right, and that's — actually, that's the thing that stays open longest, isn't it. Not 'was there a patch,' not even 'how fast did it deploy.' It's whether the window held. Whether 'no confirmed RCE' stays no confirmed RCE. Because if it does, you could argue the process — messy, under-resourced, running on people like Mudd working until 22:30 — you could argue it technically held. And if it doesn't hold, then PHP2Shell is the case study for why automatic patching stops being optional.
Eliza Ward: Neither answer is clean. That's where we actually are.
