Token Security posits that restricting the permissions of service accounts, API keys, and AI agents is equally vital to vulnerability remediation in limiting breach impact.
Researchers utilized OpenAI and Google models to discover two remote code execution flaws within the language powering 69% of the web. Attackers targeted this language before the official patch was released. The pitch, therefore, is to discover and remediate flaws with increased speed. Enterprises must reconsider this approach.
Security teams cannot patch at machine speed, yet they can constrain what an attacker can access post-exploitation by focusing on identity as the control plane. The ultimate severity of an incident relies heavily on the access rights of compromised workloads, including service accounts, API keys, cloud roles, and tokens.
The discovery of the two PHP2Shell flaws occurred in PHP's code dating back to 2012. Researchers at Calif and Wiz identified them in August, jointly disclosing them with OpenAI. Amazon observed an exploitation attempt on October 17, four days before the disclosure. PHP released the patch on October 21, and watchTowr detected in-the-wild exploitation attempts that same day.
Cloudflare noted a rapid escalation in attack traffic following the disclosure. CISA subsequently added both flaws to its list of known exploited vulnerabilities on October 26. Exploitation now frequently commences prior to public disclosure. Remediation, however, lags significantly. Verizon's 2026 DBIR indicates a median time-to-fix for a known exploited vulnerability of 43 days, while Qualys reports a mean remediation time of 21.2 days, with 63% of critical vulnerabilities remaining open after one week, amidst roughly 195 new CVEs published daily.
PHP2Shell presents unique cleanup challenges; PHP is embedded in appliances and hosting control panels that customers cannot patch themselves. Furthermore, versions 8.1 and older lacked official builds. As of October 27, Censys documented 32.5 million internet-facing PHP services running potentially vulnerable versions, alongside over 60 million services that do not report a version.
Remediation velocity will likely remain slower than exploitation velocity in the near term, even when AI-driven workflows assist patching. Agents now operate across systems with access that remains unreviewed. Token Security's AI Agent Security tool identifies every agent, links it to an owner, and restricts its capabilities.
With the exploitation gap widening, the temptation exists to concentrate solely on mitigating threats. However, even if an AI-driven scan identified 2,000 new zero-day vulnerabilities tomorrow, this only yields a list. Some findings are simple to patch, while others require more time than the team possesses.
For supported PHP branches, the direct remedy was straightforward: installing the updated release. Governments and corporations sometimes took their sites offline while awaiting this update. A more pragmatic perspective suggests that while vulnerabilities lead to exploits, and exploits lead to attacks, the enterprise impact is dictated by the reach of compromised identities. A shell on a PHP server grants access to server data, such as environment variables or cloud keys in configuration files, and PHP2Shell can leak worker memory containing passwords, tokens, and API keys.
An attacker gaining code execution on one host opens a pathway, but the most valuable assets are typically in restricted areas. Controls limiting lateral movement do not rely on winning a discovery race. Finding vulnerabilities is an open-ended process, whereas limiting a service account's reach is a measurable task.
This identity-centric approach has boundaries; if the flaw resides in the IdP or secrets manager, lateral movement is inherent. Similarly, if the issue is in the database or storage provider, the attacker is already positioned advantageously. Given constrained resources, staying vulnerability-first—cataloging advisories and scanner findings—is tempting. Yet, cataloging takes weeks, and resolving critical findings takes even longer.
The strategic bet should be to prioritize closing the most exploitable holes in core systems. This prioritizes blast radius over the CVSS score. Attackers seek the easiest path, not the most direct one. Utilizing a leaked credential to move is simpler than chaining zero-days to reach a database directly. October's headlines illustrate this; at LiteLLM, attackers used a master key exposed publicly to retrieve an unscoped GitHub organization-owner token from an internal agent platform. This identity enabled the theft of two more maintainer tokens, subversion of the release workflow, and publication of credential-stealing artifacts.
One cannot win the race to patch every server before attackers arrive, but one can define the worth of a compromised server to them. Organizations should discover and inventory every non-human identity and AI agent, beginning by securing those with the broadest reach. Assigning an owner, scoping access by purpose and intent, removing inactive credentials, and continuously governing the identity lifecycle are necessary steps. For AI agents, extending access by intent embodies treating identity as the control plane. Patching dictates patch speed; identity dictates the damage when patching cannot keep pace.
