Should you patch vulnerabilities found by AI? A realistic answer to the dilemma

"AI discovered a security vulnerability" is no longer a distant story in the news. In October 2026, PHP2Shell, which shook the PHP ecosystem, and Node2Shell, which rocked the Node.js environment, starkly demonstrated how vital AI technology has become on the front lines of cybersecurity, and simultaneously, how dangerous a variable it can be. However, the truly important question is not awe that "AI found it well," but rather, "So, what should we be doing right now?"

This article looks behind the scenes of vulnerabilities discovered by AI, aiming to untangle the real concerns faced by developers and security professionals.

1. Why Are Vulnerabilities Found by AI Only Now Making the News?

On October 21, 2026, the security industry was swept up in turmoil. This was because CVE-2026-109618 and CVE-2026-109619, critical vulnerabilities discovered in PHP and collectively dubbed PHP2Shell, were disclosed. What is even more interesting is the fact that these vulnerabilities were not the products of simple bug hunters, but results pulled from years of legacy code with the help of AI.

Previously, subtle memory state errors that were difficult to find with the human eye or traditional static analysis tools have surfaced through AI's pattern recognition and large-scale code analysis capabilities. This signifies that the security paradigm is shifting from 'reactive response' to 'proactive prediction.'

Common Patterns Shown by PHP2Shell and Node2Shell

PHP2Shell was a critical RCE (Remote Code Execution) vulnerability that had existed for as long as 14 years, from PHP 5.4 to 8.5. Like its alarming CVSS v4.0 score of 9.2, the ability to be exploited without authentication was the biggest threat. Attackers could manipulate server out-of-memory conditions or access freed memory areas to execute arbitrary code.

And just days later, a vulnerability with a similar pattern appeared in the Node.js ecosystem. Node2Shell exploited an out-of-bounds write flaw in the Brotli decoder. This was also exploitable without authentication, and it resembled PHP2Shell in that servers were left defenseless when processing compressed data coming in via Content-Encoding: br.

Comparison of major technical specifications of PHP2Shell and Node2Shell

2. AI Is Not a Solver, but Merely an 'Amplifier'

Many people mistake AI for a 'solver of security problems.' However, the reality is more cold. AI is merely a tool that 'amplifies' the scale of problems.

Microsoft Vice President Kim Tae-su's statement at SmartCloud Show 2026 that "more vulnerabilities will be discovered due to advances in AI" is based on this insight. AI digs into the corners that humans have given up on. 10-year-old PHP code, Node.js built-in modules untouched even once, and the edges of HTTP libraries that no one had verified. 'Lurking' bugs in such places are being found one by one by the microscope of AI.

The Flip Side of 'Proactive Administration': Patch Speed vs. System Stability

In line with this trend, the Ministry of the Interior and Safety is implementing a system that recognizes and grants immunity to public officials who quickly patch high-risk vulnerabilities discovered by AI as engaging in 'proactive administration.' This applies to vulnerabilities with a CVSS score of 7.0 or higher, or urgent recommendations from the National Intelligence Service and KISA. However, developers in the field may feel this policy as pressure instead.

Rushing to patch often leads to unpredictable system failures. As seen in the conflict between CrowdStrike and Windows, a single security patch can halt systems worldwide. AI only tells you, "Here is a bomb," but does not answer, "How do we safely remove this bomb?"

3. The Curse of Legacy Systems: AI Loves 'Abandoned Code' Most

The most painful lesson from the PHP2Shell incident is the danger of legacy systems. Versions of PHP 8.1 and below, which are out of official support, can hardly expect patches anymore. Many older servers still in operation by companies are inevitably helpless in the face of critical vulnerabilities found by AI.

AI models learn patterns from past vulnerabilities and excel at finding similar structural flaws in old servers currently in operation. Paradoxically, this suggests that companies with accumulated technical debt may be more heavily exposed to AI-based security threats.

The Unrealistic Nature of Migration

"It's fine, just switch to the latest version, right?" is easily said, but in actual enterprise environments, it is closer to "cannot do it" rather than "do not do it." With millions of lines of code intertwined, migrating to the latest version becomes a project in itself.

Useful in such cases are vendors' 'backports.' Debian, Red Hat, Ubuntu, etc., provide packages with the latest security patches applied even to older versions. If you are using PHP versions 8.1 or below, checking for distribution-specific backports may be the last bastion.

4. A Checklist for Practitioners: What to Check Right Now

Theoretical talk alone is not enough. Let's organize a practical guide to check if your server is safe at this very moment.

If You Are Using PHP

• Check Version: Immediately check the current version with php -v. If it is below 8.2.35, 8.3.36, 8.4.27, or 8.5.12, it is an immediate update target.
• Temporary Mitigation: If updating is difficult, change the php.ini setting.
  • memory_limit=-1
  • session.upload_progress.enabled=0
• Log Review: Examine logs after October 17, 2026, for unusual POST requests containing PHP_SESSION_UPLOAD_PROGRESS, or suspicious process creations that are not web shells.

If You Are Using Node.js

• Update Version: You must immediately update to Node.js 22.23.4 or higher, 24.22.1 or higher, and 26.12.1 or higher.
• Rebuild Containers: If you are using Docker images, rebuilding and redeploying the image is essential, not just changing the tag. node:22.23.3-alpine remains vulnerable.
• WAF Configuration: Until updating, the most certain defense is blocking inbound requests containing the Content-Encoding: br header.

5. Mindset for Developers in the Era of AI Security

Ultimately, the core of security in the AI era is not 'technology' but 'speed.' Within 48 hours, or even less, after a vulnerability is disclosed determines the success or failure of an attack. According to Zscaler's report, widespread exploitation attempts were observed just two days after the PHP2Shell vulnerability was disclosed.

Developers must now be not just people who write good code, but people who respond nimbly to change. Accepting vulnerabilities found by AI as one's own and applying them to one's system is a key competency for developers in the AI era.

Frequently Asked Questions

Q: If AI found the vulnerability, won't AI patch it automatically? A: At present, it is nearly impossible. AI is specialized in 'identifying' vulnerabilities, but judging what side effects a patch will have on the specific business logic of your application remains a human task. However, as patch automation tools develop in the future, the time required to reach the 'recommended patch' stage is expected to decrease.

Q: Our site has low traffic, so won't it be okay? A: That is a misconception. In the case of vulnerabilities requiring no authentication, bots sweep the entire web around the clock. Regardless of traffic volume, if it is vulnerable, it becomes a target for attacks.

Q: After PHP2Shell, are attacks really active on the dark web? A: Yes. Especially in Korea, discussions on attacks targeting government and financial institutions are actively taking place around the I2P network, and the possibility of involvement by sophisticated attack actors such as the Lazarus Group cannot be ruled out.

Conclusion

The phrase "vulnerability discovered by AI" may sound somewhat frightening, but in reality, it is closer to a blessing that allows us to discover risks we did not know about early. However, if we fail to turn that discovery into 'action,' it will only become an object of fear.

Is your server up to date right now? If not, start by checking the version before leaving work today. AI does not sleep, and our systems are at risk every day.

What security policies have you changed as a result of the PHP2Shell and Node2Shell incidents? Or are you still feeling the pressure from unresolved legacy systems? Please share your situation in the comments.