AI found the flaw under most of the web; Fastly is selling a wall it has not finished

AI found the flaw under most of the web, and AI is what makes it exploitable. On October 21 the PHP Foundation rushed out patches for PHP2Shell↗, two flaws that let attackers run code on any server using PHP, the language behind roughly 70% of websites ¹³. The NSA said patch immediately or take systems offline, and European governments pulled sites down ²⁴. Fastly's▼−3.86% — Fastly, down 3.86 percent today chief product officer, Kelly Shortridge, says her network carries billions of PHP requests a day and already shows evidence of active attacks ¹.

AI proved exploitable what human audits shelved

Both flaws sit in the memory handling every PHP request touches: a failed request can leave memory corrupted, the next request can inherit stale state, and either path ends in code execution before any application code runs ³⁶. Human auditors found the underlying issue in 2024 and could not prove exploitation; the fix stalled, and the PHP Foundation now calls that a structural failure↗ ⁵.

Working in OpenAI's Patch the Planet program↗, researchers at security firm Calif aimed GPT-5.6 Sol at the source and had a working exploit within two weeks of starting; Wiz found more with its Atlas agents and Google's Gemini 4 Argon ²⁵.

The attackers carry the same tools

Amazon's▼−4.68% — Amazon, down 4.68 percent today threat team logged an exploit attempt four days before disclosure↗, and Amazon CISO CJ Moses says AI-assisted analysis now turns a patch diff into a working exploit for more actors, within hours ³. The PHP Foundation says it has seen no working exploit in the wild; a team outside the response built one in a day with AI, work its researcher says took weeks before these models ⁴.

The unpatchable tail is the market

Roughly four in five internet-facing PHP services run a branch PHP no longer supports ³. The project is not fixing version 8.1 or earlier↗ ⁶. No configuration fully blocks the flaws, its security team says; updating is the only safe choice ⁵⁷. For sites that cannot patch this month, the last defense is someone filtering traffic in front of them, which is why Wiz pre-briefed Fastly, Cloudflare▼−0.51% — Cloudflare, down 0.51 percent today and the other edge vendors before disclosure to prepare mitigations for organizations that cannot update immediately ⁵. Fastly and Cloudflare already have PHP2Shell rules live ¹⁷.

Fastly sells the wall with the automation unbuilt

IDC named Fastly a Leader in web application and API protection in September, citing net revenue retention of 117% ⁹. But Network Protect, the network-layer shield launched the week before the emergency↗, filters by rules alone. The engine that would automate mitigation of volumetric attacks is still in development, no price or minimum commitment is published, and the launch's capacity headline measures Fastly's whole network, not any customer's protection ⁸.

Insiders sold the story all year

Insiders sold $89.6 million of Fastly stock over twelve months and bought none ¹⁰; CTO Artur Bergman sold about a quarter of his position in September under a pre-arranged plan ¹¹. The chief executive's mid-October sale↗ only covered taxes on vesting shares ¹². At about 140 times forward earnings, the stock already assumes the conversion ¹⁰.

The demand outlasts the emergency

The emergency passes; the condition does not. Patch-to-exploit time is collapsing for structural reasons ³, and OpenAIPVT$1.18T — OpenAI, private, latest valuation $1.18T expects AI-found flaws to keep rising↗ ¹³, so filtering in front of unpatchable software becomes a permanent utility. Fastly has the view of the traffic; the automated engine and the price list are the work that decides whether it, and not Cloudflare, gets paid for the wall. The skill that started all this, aiming a frontier model at a codebase, is learnable, and this week showed what it is worth.