Tenable gave PHP's 9.2 flaws its highest rating, then patched PHP out of its own scanners

Two flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, let an unauthenticated attacker run code on any installation serving web requests; the PHP security team rates both 9.2 out of 10, and researchers call the chain php2shell ¹. Tenable▲+5.29% — Tenable, up 5.29 percent today, the company behind the Nessus vulnerability scanner, graded the pair Vulnerability of Concern↗, its highest tier under Vulnerability Watch ¹².

Tenable graded its own products too: Tenable Security Center and Enclave Security both ship PHP, and on October 22 the company shipped precautionary patch SC-202610.1↗, moving them to the fixed PHP 8.2.35 ¹. Exploitation had begun on October 17, four days before disclosure, on Amazon's▼−0.80% — Amazon, down 0.80 percent today MadPot honeypots ¹.

One prompt found what a decade missed

The affected code path dates to PHP 5.4.0, released in 2012 ¹. The PHP Foundation credited Calif, Wiz and OpenAIPVT$1.18T — OpenAI, private, latest valuation $1.18T; both research teams say AI models did part of the finding ¹. Chainguard chief executive Dan Lorenc says the night his team was briefed it rediscovered the same flaw with a frontier model given one prompt↗: "find bad vulnerabilities in PHP" ³.

Tenable research engineer Satnam Nerang wrote on October 23 that "AI-assisted vulnerability discovery is creating larger haystacks, but it isn't finding more needles ². These flaws are the needles" ². Unit 42 counts over 22.6 million internet-exposed instances as potentially vulnerable; the NSA, FBI and CISA urged patching, with CISA telling those who cannot update to take systems offline ³¹.

Tenable sells the haystack to the agents

Tenable's commercial answer landed on October 20, the day the CVE identifiers leaked↗: OPEN for AI, twelve launch partners including SentinelOne▲+6.00% — SentinelOne, up 6.00 percent today, Splunk and Snyk, feeding exposure data to agents through the Hexa AI MCP server (the agent-tool protocol) and the CyberAgents Exchange marketplace ⁴. Product chief Eric Doerr's claim of "the only exposure management provider offering a truly unrestricted, vendor-agnostic ecosystem of validated AI use cases" arrived with no independent benchmark ⁴⁵.

A day later, partner SentinelOne unveiled Singularity ASOC↗, an autonomous security operations center whose Purple models have completed more than 400,000 investigations and saved an estimated 332,000 analyst hours, with Tenable among its 50-plus ingested data sources ⁶. SentinelOne, fresh from a $1.44 billion zero-coupon raise, is partner and possible substitute at once: the agent sits above every scanner, Tenable's included ⁶.

The price already assumes the boom

TENB rose 4.3% on October 21↗ to $40.67, near the 52-week high of $43.67 ⁷. That is 18.6 times forward earnings against 701.2 times trailing; GuruFocus ranks profitability 3 of 10, and insiders were net sellers of $2.4 million over a year ⁷. The demand case is real: patch cycles are flooding with AI-assisted flaws ², and Evercore▼−1.00% — Evercore, down 1.00 percent today ISI says the flaw may spur security remediation work ⁴. Net income has swung between -$22.9 million and +$3.8 million a quarter since the start of 2025 ⁸.

Watch the catalog, then the earnings call

The CISA Known Exploited Vulnerabilities catalog still lacked both CVEs on October 22 ¹. The fiscal third-quarter report, due within weeks ⁴, will show whether October became renewals rather than one quarter of scanning, and whether the $400 million revolver Tenable closed this month buys the agent layer instead of another scanner. Finding the needle now costs one sentence of prompt; owning the map of what is exposed is what still gets paid.