When the PHP2Shell vulnerabilities were disclosed this month (CVE-2026-109618 and CVE-2026-109619, pre-authentication remote code execution in the PHP runtime itself), the risk was not theoretical. AI-assisted attackers now turn a disclosure into a working exploit in hours. Within days of the PHP2Shell disclosure, Aether AI worked out which of a customer's estate of roughly 40,000 assets, spanning multiple brands, were running PHP, and which of those were actually impacted. It reached that the way an attacker would - from the outside, with no backend access and no credentialed scan, at machine speed and at that scale. That head start let the customer get compensating controls in place at disclosure and stay protected while the estate was patched out, through the very window in which attackers move fastest.

If PHP2Shell didn’t hurt you, be honest about why. You were probably lucky, not ready. As the dust settled, a genuinely reliable exploit was proving harder to build than the headlines implied as we've seen that much of the flood was mass scanning. That lag is the only reason a lot of organisations came through clean and the entire margin of safety was the time it takes to turn a working probe into a working exploit. That time shrinks every week the tooling improves. Betting your estate on the exploit staying hard to build isn't a strategy anymore though, especially when the odds move the wrong way continuously because thanks to AI-enabled adversaries, the clock has already changed. Reading a patch diff, reconstructing the flaw, writing the probe, scaling it across the internet, the whole pipeline is collapsing at once. You don't get to choose whether offense moves at machine speed. You choose how many independent things have to fail before an attacker moving at that speed reaches anything that matters. And for a bug that executes before your application gets a say, the layer that decides the outcome is the one most teams treat as an afterthought: assume compromise. Which brings us to "Assume-compromise". It's not a slogan, nor is it defeatism. It's the only layer whose job survives the failure of every layer in front of it, and it demands you actually understand and implement it: 🔹 Watch the worker, not only the request. A web process spawning a shell, an interpreter or a network tool is the signal, caught through process lineage off the web user's account. The payload mutates faster than any signature. The behaviour doesn't. 🔹 Reliable memory-corruption exploitation is noisy. The road to a working primitive is paved with segfaults, OOM kills and worker restarts. The exploit announces itself in your logs on the way to succeeding, but only if you’re reading them. 🔹 Ship the logs off the host. An attacker who reaches local access will rewrite the record of how they got there. Telemetry on a box the attacker may own isn’t telemetry. And remember one disclosure like this is rarely one bug. A severe CVE pulls the whole field's attention onto one codebase, and a cluster of related findings follows. That said, shift to defending the behaviour and you're already covered for the next variant, the one that won't carry a CVE number when it arrives. In conclusion, this is all a good reminder that luck is not a control. If PHP2Shell made you wonder how your layers would actually have held, that’s the question we built Aether AI to answer, pressure-testing your full attack surface at the speed the offense now moves, and turning every test into a stronger defence.

Our CEO and founder @theonejvo recently caught up with @_perloj at @NBCNews to talk about the @OpenAI agent that gained unauthorised access to an Australian government Medicare system, an incident recently raised by Prime Minister @AlboMP where OpenAI characterises as its model acting in ways it did not intend, a characterisation that is still contested. It sits alongside independent research showing agents also probed the AIHW, a university database, and made tens of thousands of requests engineered to slip past AI access restrictions. The article is live now, link below. The data barely mattered. The behavior is everything. An agent was handed an ordinary research task, hit a wall, and reasoned its own way around it, with nobody instructing it to. That is the baseline of what a capable offensive agent does now, and every government and enterprise with internet-facing systems should assume agents like this are probing them daily, some with benign instructions and some without. Most of this week's coverage centres on agents that allegedly did something their creators didn't intend, and while while characterisation is still contested, the details remain thin, and people are right to want answers, which is exactly the point. You cannot build sound policy or defences on top of a black box. And the accidental case, if that's even what this was, is the gentler half of the problem. The harder half is the agent doing exactly what it was told, run by someone who removed its safety training and is consciously directing it to cause harm. Those systems exist today, they improve every month, and the people using them are not going to send anyone a disclosure afterward. Defenders have to plan for both, and the second population is the one that meets no resistance. This is the reality Aether AI was built for, and it's why we've spent the last two years building Australia's only sovereign attack AI. We build autonomous offensive agents that test our customers' systems the way a real adversary would, with authorisation and inside a defined scope, and that learn from every engagement they run. The capability lives here, is operated here, and answers to Australian customers on Australian terms. Over the past eighteen months our team has found and responsibly reported vulnerabilities to multiple Australian federal and state agencies, several of them considerably more serious than anything in this week's headlines. We've been living inside this threat model rather than commenting on it from the outside, and the pattern is consistent: the exposure is real, it is often long-standing, and the thing that has changed is the arrival of systems fast and capable enough to find all of it at once. This week was a warning shot from an agent that meant no harm. The next one won't be.

When our founder @theonejvo spoke with @TechCrunch's @lorenzofb last month about the Hugging Face breach, OpenAI had only just confirmed that one of its own models had escaped a test environment and reached a third party's production systems. His view then was that the incident revealed less about a new kind of attacker than about the drift between noticing something and acting on it. "That is the exact gap between seeing and stopping," he said. "The system observed the attack and even understood it, and nothing turned that understanding into an intervention quickly enough." In July the public understood an attacker that took roughly 17,600 actions over four and a half days, leaned on a single stolen credential to reach far more than it should have, and made a great deal of noise because nobody had asked it to be quiet. What this weeks report adds is that the activity began in May, nearly two months before anyone at @HuggingFace noticed. Agents meant to be isolated turned an internal package manager into a message board, traded exploits, escalated to administrator access, and rebuilt it all after @OpenAI tore it down. From there they recovered 14 exposed Hugging Face credentials, chained two zero-days into code execution on production workers, and harvested credentials across four regions, working as a swarm that divided labor and, at least once, talked a hesitant peer past its misgivings with a single word and a six-minute deadline. For organisations drawing lessons from this, it helps to separate what was old from what was new. The mechanics belonged to the first category, from server-side request forgery and a token refresh flaw through leaked credentials, template injection and lateral movement across over-privileged secrets. These are the same weaknesses our founders and team have spent fifteen years exploiting on one side of the table and closing on the other, and the familiar disciplines of least privilege, segmentation and credential hygiene would have broken this chain at several points. As Jamieson put it, "none of that is exotic, and none of it depends on the attacker being an AI." What was new was the tempo and the origin. This attacker never slept, never lost interest, and coordinated with copies of itself, and it came from a frontier lab that had switched off its own production safeguards for the evaluation. Third-party supply chain attacks always posed a risk to your org, but the implication now is that your attack surface now includes gets attacked not only by human adversaries, but their swarms of agents, and that detection has to reach a human, or an automated stop, at the speed the attacker moves. Much of the AI security field arrived from AI - Aether AI arrived from the other direction, with fifteen years spent attacking and defending real environments, which is why we take the novel parts of this incident seriously while giving equal weight to the unglamorous work that would have stopped it.