--- title: "AI found the flaw under most of the web; Fastly is selling a wall it has not finished" description: "PHP shipped emergency patches on October 21 for two flaws found by AI audits, with attacks already visible on Fastly's network. The company selling the filtering launched its network-layer shield a week earlier with the automated engine unfinished and no price published." publisher: "The Inference" section: "Security" published: 2026-10-22T17:20:49.069Z modified: 2026-10-22T17:20:49.069Z canonical: https://theinference.org/article/ai-found-the-flaw-under-most-of-the-web-fastly-is-selling-a-wall-it-has-not-finished language: en keywords: "Security, Fastly, PHP, AI Security, OpenAI, Vulnerability" --- # AI found the flaw under most of the web; Fastly is selling a wall it has not finished > PHP shipped emergency patches on October 21 for two flaws found by AI audits, with attacks already visible on Fastly's network. The company selling the filtering launched its network-layer shield a week earlier with the automated engine unfinished and no price published. AI found the flaw under most of the web, and AI is what makes it exploitable. On October 21 the PHP Foundation [rushed out patches for PHP2Shell](https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/), two flaws that let attackers run code on any server using PHP, the language behind roughly 70% of websites [1][3]. The NSA said patch immediately or take systems offline, and European governments pulled sites down [2][4]. [Fastly](https://theinference.org/markets/companies/fastly)'s chief product officer, Kelly Shortridge, says her network carries billions of PHP requests a day and already shows evidence of active attacks [1]. ## AI proved exploitable what human audits shelved Both flaws sit in the memory handling every PHP request touches: a failed request can leave memory corrupted, the next request can inherit stale state, and either path ends in code execution before any application code runs [3][6]. Human auditors found the underlying issue in 2024 and could not prove exploitation; the fix stalled, and the PHP Foundation now [calls that a structural failure](https://www.unite.ai/php-patches-two-critical-rce-flaws-found-with-frontier-ai-models/) [5]. Working in [OpenAI's Patch the Planet program](https://techcrunch.com/2026/10/21/php-armageddon-openai-googles-wiz-find-ancient-holes-panicking-the-internet/), researchers at security firm Calif aimed GPT-5.6 Sol at the source and had a working exploit within two weeks of starting; Wiz found more with its Atlas agents and Google's Gemini 4 Argon [2][5]. ## The attackers carry the same tools [Amazon](https://theinference.org/markets/companies/amazon)'s threat team [logged an exploit attempt four days before disclosure](https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html), and Amazon CISO CJ Moses says AI-assisted analysis now turns a patch diff into a working exploit for more actors, within hours [3]. The PHP Foundation says it has seen no working exploit in the wild; a team outside the response built one in a day with AI, work its researcher says took weeks before these models [4]. ## The unpatchable tail is the market Roughly four in five internet-facing PHP services run a branch PHP no longer supports [3]. The project is [not fixing version 8.1 or earlier](https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619) [6]. No configuration fully blocks the flaws, its security team says; updating is the only safe choice [5][7]. For sites that cannot patch this month, the last defense is someone filtering traffic in front of them, which is why Wiz pre-briefed Fastly, [Cloudflare](https://theinference.org/markets/companies/cloudflare) and the other edge vendors before disclosure to prepare mitigations for organizations that cannot update immediately [5]. Fastly and Cloudflare already have [PHP2Shell rules live](https://theinference.org/article/palo-alto-networks-has-no-pan-os-fix-for-php2shell-calls-it-9-2-and-sells-a-paid-virtual-patch) [1][7]. ## Fastly sells the wall with the automation unbuilt IDC named Fastly a Leader in web application and API protection in September, citing net revenue retention of 117% [9]. But Network Protect, the network-layer shield [launched the week before the emergency](https://www.fastly.com/blog/defense-without-detours-introducing-fastly-network-protect), filters by rules alone. The engine that would automate mitigation of volumetric attacks is still in development, no price or minimum commitment is published, and the launch's capacity headline measures Fastly's whole network, not any customer's protection [8]. *Chart: **Revenue keeps climbing at Fastly while losses persist** Line chart of Fastly's quarterly revenue rising from about $128 million to $183 million over twelve quarters while net income stays negative, improving from about -$54 million to about -$16 million.* *Quarterly revenue and net income in US$ millions as reported, twelve quarters to June 30, 2026. [14]* ## Insiders sold the story all year Insiders sold $89.6 million of Fastly stock over twelve months and bought none [10]; CTO [Artur Bergman](https://theinference.org/markets/people/artur-bergman) sold about a quarter of his position in September under a pre-arranged plan [11]. The chief executive's [mid-October sale](https://www.sec.gov/Archives/edgar/data/1517413/000151741326000306/0001517413-26-000306-index.htm) only covered taxes on vesting shares [12]. At about 140 times forward earnings, the stock already assumes the conversion [10]. ## The demand outlasts the emergency The emergency passes; the condition does not. Patch-to-exploit time is collapsing for structural reasons [3], and [OpenAI](https://theinference.org/markets/companies/openai) [expects AI-found flaws to keep rising](https://www.helpnetsecurity.com/2026/10/22/openai-vulnerability-disclosure-plan/) [13], so filtering in front of unpatchable software becomes a permanent utility. Fastly has the view of the traffic; the automated engine and the price list are the work that decides whether it, and not Cloudflare, gets paid for the wall. The skill that started all this, aiming a frontier model at a codebase, is learnable, and this week showed what it is worth. ## Takeaway AI turned a flaw human auditors shelved in 2024 into a working exploit in two weeks, and attacks are already visible on the edge, but Fastly, the vendor best placed to sell the wall, launched its network-layer filter without the automation or pricing that would let it collect. ## Sources 1. [SiliconANGLE, Critical PHP vulnerabilities send organizations scrambling to secure their systems, 21 October 2026](https://siliconangle.com/2026/10/21/critical-php-vulnerabilities-send-organizations-scrambling-to-secure-their-systems/) 2. [TechCrunch, PHP armageddon: OpenAI, Google's Wiz find ancient holes, panicking the internet, 21 October 2026](https://techcrunch.com/2026/10/21/php-armageddon-openai-googles-wiz-find-ancient-holes-panicking-the-internet/) 3. [The Hacker News, Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed, 22 October 2026](https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html) 4. [CNBC, Why governments pulled websites offline over the decades-old PHP programming language, 22 October 2026](https://www.cnbc.com/2026/10/22/php2shell-vulnerability-what-is-it-and-is-your-data-at-risk.html) 5. [Unite.AI, PHP Patches Two Critical RCE Flaws Found with Frontier AI Models, 21 October 2026](https://www.unite.ai/php-patches-two-critical-rce-flaws-found-with-frontier-ai-models/) 6. [Google Cloud Blog, Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, 21 October 2026](https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619) 7. [BleepingComputer, PHP ships emergency patches for critical PHP2Shell flaws, 21 October 2026](https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/) 8. [Fastly blog, Defense Without Detours: Introducing Fastly Network Protect, 14 October 2026](https://www.fastly.com/blog/defense-without-detours-introducing-fastly-network-protect) 9. [Security Solutions Media, Fastly Named a Leader in 2026 IDC MarketScape for Worldwide WAAP Platforms, 22 October 2026](https://www.securitysolutionsmedia.com/2026/10/22/fastly-named-a-leader-in-2026-idc-marketscape-for-worldwide-waap-platforms/) 10. [GuruFocus, Fastly Inc (FSLY) Stock Down 4.0% but Still Overvalued, GF Score 54/100, 20 October 2026](https://www.gurufocus.com/news/9132955/fastly-inc-fsly-stock-down-40-but-still-overvalued-gf-score-54100) 11. [MarketBeat, Fastly (NASDAQ:FSLY) Shares Climb 8.9% - Time to Buy?, 21 October 2026](https://www.marketbeat.com/instant-alerts/price-fastly-nasdaq-fsly-shares-climb-89-time-to-buy-2026-10-21/) 12. [SEC Form 4, Fastly, Inc., Charles Lacey Compton III (CEO), filed 20 October 2026](https://www.sec.gov/Archives/edgar/data/1517413/000151741326000306/0001517413-26-000306-index.htm) 13. [Help Net Security, AI-found bugs are expected to rise, and OpenAI has a five-stage response plan, 22 October 2026](https://www.helpnetsecurity.com/2026/10/22/openai-vulnerability-disclosure-plan/) 14. [Fastly, quarterly figures from its SEC filings, retrieved 22 October 2026](https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001517413) --- AI found the flaw under most of the web; Fastly is selling a wall it has not finished — The Inference. Canonical: https://theinference.org/article/ai-found-the-flaw-under-most-of-the-web-fastly-is-selling-a-wall-it-has-not-finished