Security teams spent much of this week patching PHP, a scripting language that serves web requests on servers around the world.
A flaw with a head start
On 21 October the PHP project released emergency updates for two critical flaws, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale, that can let an unauthenticated attacker run code remotely on an affected web server. The pair has been nicknamed PHP2Shell.
Researchers at Wiz, Calif and OpenAI found and reported the flaws, which affect nearly every PHP version back to PHP 5.4. PHP’s advisory says any installation serving web requests is at risk. It flags Apache’s mod_php as the highest risk, because a single unauthenticated request can trigger the attack before any application code runs.
The timing made it harder. Details leaked on social media on 20 October, ahead of a planned 22 October disclosure. Amazon Threat Intelligence later identified an exploitation attempt dating back to 17 October, four days before the public announcement. Security firm watchTowr said it was seeing exploitation attempts of both flaws by 21 October. The fix is to patch. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and Datadog’s security team says only patching fixes the flaws, and some mitigations circulating in the community don’t fully protect you. Cloudflare also switched on default protections for its free and paid firewall customers from 21 October.
It isn’t quite over. On 23 October the PHP project published an advisory for a related flaw, CVE-2026-115560, which affects fully patched releases including 8.5.12 and will be fixed in the next regular release. For most small businesses, the practical step is to ask whoever runs your website or hosting to confirm PHP has been updated to a fixed release. cloudflare
AI already has access
PHP2Shell is a story about attackers finding a way in. Andrew Kay, Director Solutions Engineering APJ at Illumio, writing about AI agents, looks at the access a business has already handed out.
Kay writes that for Australian small businesses, “AI is starting to look less like a futuristic experiment and more like an extra employee.” He points to the National AI Centre’s June 2026 report, which found 43 per cent of Australian small and medium businesses reported some level of AI adoption across the December 2025 to February 2026 quarter.
Then comes the warning. “But the more responsibility SMBs hand to AI, the more important it becomes to understand what these systems can access, what they can do and who is overseeing their work,” Kay writes.
He draws a line between agents and the chatbots most people know. “An AI agent is different from a chatbot that simply answers questions,” he writes. Depending on how it is set up, he says, an agent can work inside business applications, retrieve information, change records and carry out tasks with little human involvement.
That is where his comparison with an outside attacker comes in. “An external attacker typically needs to steal credentials, exploit a vulnerability or find another way into a business’s systems. An AI agent operating with legitimate credentials may already have authorised access to sensitive applications and data,” Kay writes.
Kay says agents can go wrong in ordinary ways. “AI agents can make mistakes, misinterpret instructions or be manipulated while operating with the privileges the business has given them,” he writes. The harder part is spotting it. “Because their actions may look like routine automated work, businesses may struggle to identify when something has gone wrong.”
He says the Australian Cyber Security Centre warned in September 2026 that AI agents had taken unexpected actions while trying to complete assigned tasks, including attempting to progress activity without direct human authorisation. Illumio’s own research, he adds, found 35 per cent of local organisations said AI had accessed data it should not have.
Smaller businesses sit in a tougher spot. “Smaller businesses are especially at risk, as they increasingly use AI to perform work that touches their core operations, often without dedicated teams to assess the security implications,” Kay writes.
He gives examples. An agent connected to a customer management platform might expose more than intended. One used in IT operations could change configurations or permissions. A tool supporting security investigations may have access to logs, identities and infrastructure.
Five practical guardrails
Kay isn’t telling owners to walk away from the technology. “None of this means smaller businesses should avoid AI. With the right oversight, these tools can deliver tremendous value,” he writes.
His first tip is to treat each AI agent like any other identity in the business. “They should have only the permissions necessary to perform their assigned tasks, rather than broad access,” he writes.
Second, keep a running picture of what’s in use. “Know which AI tools are in use, what systems they connect to and what information they can access,” Kay writes. He adds that “permissions should be reviewed as tools and responsibilities change, with unused access removed rather than left in place indefinitely.”
Third is human sign off. “Human oversight remains important, particularly for actions with significant consequences,” he writes. His example is an agent that can flag a suspicious account or recommend a configuration change without automatically being allowed to disable critical systems.
Fourth, keep records. “Businesses need records of what their agents do, the resources they access and the changes they make,” Kay writes. He also suggests working out how an agent could be stopped or isolated quickly if it behaves unexpectedly.
Fifth, limit how far an agent can roam. “Restricting unnecessary connections between applications and systems can help prevent a compromised agent from becoming a pathway to more valuable assets,” he writes.
Budget for the downside
Kay says the financial case for AI has to include the risk. “A tool that saves several hours a week is still a poor investment if it also creates an avoidable cyber catastrophe,” he writes.
“Small businesses do not need the security budgets of large enterprises to start doing this well. They need to understand what their AI tools can do, limit their authority to what is necessary and prepare for the possibility that something will go wrong,” Kay writes.