If you’re running PHP, you patched yesterday. You had to. Two remote code execution vulnerabilities across the entire 8.x line, exploits circulating since Tuesday night, and a coordinated disclosure process that fell apart when someone leaked the CVE IDs to online forums before the fixes were ready.

The technical details matter less than the timing. According to the PHP Foundation, the CVE IDs started circulating on Tuesday, October 20th, around 15:00 UTC. The patches dropped the next day. That’s not enough time when you’re dealing with RCE bugs in one of the web’s foundational languages.

What makes this different is how the bugs were found. Not by a researcher with a fuzzer and six months of patient work. By AI agents scanning codebases at scale, finding vulnerability patterns faster than the disclosure ecosystem can handle.

The disclosure system wasn’t built for this

Coordinated disclosure works when everyone moves at human speed. A researcher finds a bug, privately notifies the maintainers, waits 90 days while a fix gets written and tested, then publishes. The system depends on information staying contained during that window.

That breaks when AI agents can scan millions of lines of code and identify potential vulnerabilities in hours. It breaks further when those findings leak, intentionally or not, before patches are ready. And it breaks completely when exploit code starts circulating while sysadmins are still reading the advisory.

OpenAI clearly sees this coming. They just launched “Patch the Planet,” a coordination system that connects security researchers, maintainers, and incident responders to handle critical vulnerabilities in open source. The timing isn’t coincidental. When your AI agents are finding bugs faster than the existing process can handle them, you need new infrastructure.

The question isn’t whether AI will find more vulnerabilities. It will. It already is. The question is whether we can build disclosure and patching systems that operate at the same speed.

What actually broke

One developer who analyzed the PHP vulnerabilities argues there isn’t an easy exploit path, despite the RCE classification. The bugs exist, the severity is real, but actually weaponizing them requires specific conditions that aren’t trivially met. That matters for risk assessment, but it doesn’t change the fundamental problem.

When CVE IDs leak early, defenders don’t get nuanced technical analysis. They get “critical RCE in PHP” and a race to patch before someone figures out the exploit path. Even if the bugs are hard to trigger, the leak compressed the response window to essentially zero.

The PHP Foundation is working on strengthening their security process. They’ll need to. So will every other major open source project, because this is the new normal. AI agents are going to keep finding bugs, and the disclosure ecosystem needs to catch up.

The infrastructure gap

GitHub is already preparing for this future. Their engineering team just published details on moving 99.99999% of GitHub’s repositories to Azure, implementing per-reference quorums for the remainder, and building object storage systems that let reads scale independently. That’s the infrastructure you need when AI agents are treating your entire codebase as a dataset.

Google Cloud is bringing OpenAI models to Gemini’s Model Garden through their marketplace. OpenAI just released a CLI tool. The access points for AI-driven code analysis are multiplying faster than the security processes around them.

None of this means AI agents finding vulnerabilities is bad. It’s good, obviously, to find and fix security holes. But finding them faster doesn’t help if we can’t patch them faster, can’t coordinate disclosure faster, and can’t give defenders time to respond.

The PHP leak exposed the gap between AI-speed discovery and human-speed response. Patch the Planet is one attempt to close it. There will need to be others, because every major codebase is about to get scanned by agents that don’t care about disclosure timelines or coordination windows.

Patch your PHP installations. And start thinking about what your disclosure process looks like when the bugs arrive faster than you can fix them.