# Quo vadis, AI - when we switch off the internet ourselves > AI finds flaws faster than we patch them. PHP2Shell, Claude Mythos, an AI-run espionage campaign and an attack on Polish energy - a column on disconnecting. - Source: https://snok.ai/en/news/blog/quo-vadis-ai-switching-off-the-internet/ - Author: Jacek Bugajski - Published: 2026-10-29 --- On Wednesday 21 October 2026, Poland's Central Informatics Centre (COI) temporarily took down the Public Information Bulletin sites hosted on its centralised platform. The same day, the French Interior Ministry pulled its prefecture websites, Germany's ITZBund took several government sites offline, and the Netherlands and Finland did the same with some public services. The Wikimedia Foundation shut down a number of its auxiliary services. None of them had been attacked. Their own administrators switched them off, because that was the safer option. The reason was a pair of flaws in the PHP core, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619). The PHP team rated both at 9.2 out of 10. They allow remote, unauthenticated code execution on any server that handles web requests in PHP, which, according to Euronews and AFP, runs roughly 70% of the world's websites. One of the flaws was found in August by Calif during a PHP audit funded by OpenAI, which says the work used its GPT-5.6 Sol model. Wiz, now part of Google, found and reported both flaws independently. The security industry has been saying for years that AI changes the game. Last week we saw what that looks like in practice: states, rather than defending their websites, switched them off. My argument is simple and somewhat uncomfortable. If the lights go out, it will not be because of one great attack on the network. It will happen through a series of our own decisions to disconnect, made more often and on a wider scale each time. I consider it settled that we will be cutting ourselves off from the internet and the cloud. The open question is whether we do it to a plan or in a panic. ![A hand pulling a network cable out of a switch in a server rack](https://snok.ai/images/blog/quo-vadis-ai-kabel.webp) *The cover image was generated by AI from a photograph of the author; the other images in this post were also generated by AI.* ## PHP2Shell - a four-day head start for the attackers The timeline matters more than the flaws themselves. Amazon Threat Intelligence observed an exploitation attempt in its honeypots on 17 October, four days before the patches shipped. On 20 October the CVE identifiers leaked, so the PHP team brought the release forward by a day. Patches came out on 21 October, alongside advisories from CERT Polska, CISA and CERT-EU. The US National Security Agency advised taking offline any system that could not be patched straight away. On patch day CISA still said it had seen no exploitation, and the shutdowns were precautionary, as COI and German officials stated plainly. Five days later, on 26 October, CISA added both flaws to its Known Exploited Vulnerabilities catalogue (KEV). On 28 October SecurityWeek, citing the firm Dream, described a China-linked operation: the attackers scanned the internet for 19,000 firewalls from a single vendor, picked 240 targets in the US, Japan, Taiwan and South Korea, and on 23 and 24 October attacked 25 devices, leaving a root-level web shell on 24 of them. In one case, in an environment linked to the US government, they moved from the firewall to the server that manages all of the organisation's firewalls, and from there into Active Directory. The device meant to protect the network became the way in. For now that is one firm's account. On 27 October Wiz wrote that its own telemetry had not yet shown a successful end-to-end attack, although partners had privately shared working exploits with it. According to Wiz, a week after disclosure fewer than 53% of the organisations originally affected were still vulnerable. One sentence in the CISA alert struck me most: the presence of PHP in a product may not be directly visible. In other words, many organisations did not know whether they had anything to worry about. Those with an up-to-date inventory patched. Those without one switched off everything that might have PHP underneath. According to CNN, many large platforms kept running, because they are built on other languages or can roll out a fix within hours. We covered the week in which PHP2Shell coincided with fixes for Node.js and Oracle in our [Weekly Review W43](https://snok.ai/en/news/blog/weekly-review-w43-fire-in-the-foundations/). ![A Polish IT team in a Warsaw office in the evening, at a laptop with a printed list of systems](https://snok.ai/images/blog/quo-vadis-ai-war-room.webp) ## AI reads code faster than we can fix it PHP2Shell fits a pattern we have been watching since the spring. On 7 April 2026 Anthropic described its Claude Mythos Preview model. According to the company, the model found and was able to exploit zero-day vulnerabilities in every major operating system and browser, including a bug in OpenBSD that had survived for 27 years. Anthropic said more than 99% of the vulnerabilities it found were still unpatched, and it did not release the model publicly; access went to selected maintainers of critical software under Project Glasswing. These are the vendor's own claims, most of the findings cannot be checked today, and Bruce Schneier has publicly questioned the idea that this model is clearly ahead of the rest. An example from the SAP world is closer to our daily work. According to SecurityBridge Research Lab, a working exploit for a flaw in SAP Message Server (CVE-2026-58240, rated 9.8) appeared 96 hours after the SAP Security Patch Day of 8 September, with an AI assistant speeding up the most tedious part of the job, matching the byte format. A few years ago SAP teams measured the patching window in weeks. Today it is safer to measure it in days. The nature of the work is changing. Finding a flaw in mature, repeatedly audited code used to be the preserve of a small group of specialists. It is turning into a compute bill. Anthropic itself reports that over a thousand scanner runs against OpenBSD cost less than USD 20,000. ## Anthropic's prospectus - 94 pages of risk On 26 October 2026 Anthropic filed its registration statement (Form S-1) with the US Securities and Exchange Commission. The risk factors section runs to 94 pages, from page 26 to page 119. I recommend it to anyone who still regards AI risk as an invention of columnists, because this time the risks are set out by a model developer, with legal liability to investors. Anthropic states plainly that its models have been, and may continue to be, used or manipulated to generate harmful content and carry out harmful actions, including cyberattacks, with attackers getting round its safeguards through techniques such as prompt injection. It also admits that its safeguards and monitoring systems have at times been misconfigured or inadvertently switched off. And it warns that, because of its vulnerability-discovery capabilities, state actors may target the Mythos model itself, while groups with AI technology of comparable offensive capability may overwhelm its own defences. If the company that built one of today's strongest tools for finding flaws tells investors its defences may not hold against attackers with similar technology, the rest of us should stop pretending our own situation is any different. ## The human is no longer the bottleneck The most unsettling document of the past year in this field concerns how attackers operate. On 13 November 2025 Anthropic described an espionage campaign by a group it assessed with high confidence to be Chinese state-sponsored. According to the company, AI carried out 80-90% of the campaign against around thirty targets: technology firms, financial institutions, chemical manufacturers and government agencies. A human made four to six key decisions per campaign. At its peak the AI was sending thousands of requests, often several per second. A small number of the intrusions succeeded. The conclusion I draw for myself is this. An attacker no longer needs to outdo the defender at every step. It is enough to set the objective and sign off a handful of decisions, and a machine that does not tire at three in the morning does the rest. People accelerate this in two ways: those on the wrong side choose targets and work round the models' safeguards, while those on the right side deploy systems faster than they can inventory them. I suspect the second group is the larger one, and its contribution rarely makes it into the reports. We wrote about this recently in Safe Tuesday, on [shadow AI and agents outside IT's control](https://snok.ai/en/news/blog/shadow-ai-agent-governance-uipath/). The same model that helps find a PHP flaw before a criminal does can, in other hands, shorten the road to an exploit. What decides this race is the speed of moving from knowledge to action: from report to patch on one side, from patch to attack on the other. The quality of the model itself comes second. ![An electrical substation and a mobile phone mast at dusk, with the Warsaw skyline behind them and one district in darkness](https://snok.ai/images/blog/quo-vadis-ai-siec.webp) ## From a website to the radiator A government information page is the least of our problems. On 29 December 2025 a coordinated cyberattack hit the Polish energy sector: at least 30 wind and solar farms and a combined heat and power plant that supplies heat to almost half a million customers. According to Poland's Ministry of Digital Affairs and CERT Polska, the attack had been long in preparation and was state-sponsored, and the malware was designed to destroy data permanently and disable industrial devices. Energy supplies were not interrupted. This attack has not been attributed to AI, and I am not suggesting otherwise. It does show where the stakes lie: months of patient preparation inside industrial networks. My worry is that AI will shorten those months. The second lesson concerns dependencies. On 20 October 2025 a DNS fault in the DynamoDB service in AWS us-east-1 took dozens of widely used services worldwide offline for many hours. On 18 November 2025 Cloudflare failed to serve a large share of its traffic for about three hours; the cause was a database permissions change, not an attack. If an ordinary configuration error could do that, it is easy to imagine what someone looking for such a weak point on purpose could achieve. Energy, mobile networks, payments and the cloud all depend on one another. A base station without mains power runs for as long as its batteries last. A card terminal without connectivity cannot take a payment. A cloud without a network is unavailable to its users even if everything in the data centre is running. In a chain like that, the weakest link is often a system nobody knows how to disconnect and run on its own, even when nobody has attacked it. ## When we unplug the internet When I was doing penetration tests on SAP systems, I once had a client's administrator, on seeing that I had root on a production system, simply pull the network cable out of my laptop. The simplest possible response to an intruder: cut them off from the network. I think we are returning to that reflex, only at a different scale. Before long we will be pulling the cable not on a pentester but on the whole organisation, so that swarms of AI agents cannot reach our assets.

SNOK Press ยท book to download

SAP Cybersecurity from A to Z

Attack paths into SAP systems, authorisations, AI agents as both a threat and a defence, building your own red team lab, and ready-made audit checklists. 304 pages, English and Polish editions, available with a business email address.

Download the book
What follows is a forecast, not a statement of fact. I believe that within the next few years a controlled disconnection from the internet will become routine procedure in companies and public administration, just as restoring from backup is today. A few times a year, for hours or days, whenever a flaw turns up in something we run everywhere and there is no patch yet. What I do not believe in is a mass exodus from the cloud. The PHP2Shell week showed the opposite: the fastest to patch were those with automation and large teams, the cloud and platform operators themselves. We will stay in the cloud and at the same time learn to operate without it. I see that as mature architecture. That architecture starts with a few decisions that few boards take today. The first is a complete inventory of internet-facing software, including what sits inside the products we buy. Without it, every flaw in a widely used component ends with switching everything off blindly. The second is authority. The on-call administrator who cuts off a system at two in the morning has to act on rules the board agreed beforehand, not on approval sought by phone in the middle of an incident. The third is an island mode for critical processes: local copies of data, procedures on paper, backup communications and emergency power measured in the company's working hours, not in minutes. The fourth is the simplest and the most often skipped: it has to be rehearsed. A plan nobody has rehearsed works only during an audit. ![A binder of procedures, a two-way radio, a closed laptop and a power bank on a table in a crisis room](https://snok.ai/images/blog/quo-vadis-ai-tryb-offline.webp) ## What I do not know yet I do not know whether last week we switched off too much or too little. On 21 October nobody had publicly confirmed a successful attack, so the shutdowns looked like an excess of caution. Five days later the flaws were in the KEV catalogue, and firewalls in a government environment already carried web shells. With the next flaw, and a working exploit on day one, the same caution may prove too slow. Nor do I know who will be first to cross the threshold beyond which AI finds flaws faster than people can understand them, let alone fix them. When it expanded Project Glasswing, Anthropic assumed that models of this class would appear at other labs within 6-12 months. If that holds, the window between disclosure and attack will keep shrinking, and the effort will shift from patching to containing the damage and to the ability to disappear from the network for a while. What I do know is where to start: with a list of the systems we run, and an answer to the question of which of them we can switch off within an hour without stopping the business. The second step is to test our own infrastructure with the same methods an attacker will use. That is why SNOK already offers its own black-box units for penetration testing on a commercial basis: devices running local language models without refusal filters (uncensored), together with the toolset every pentester knows, wrapped in the appropriate organisational framework and safeguards. The model runs entirely on the device, with no vendor cloud involved, so we can rehearse an AI-assisted attack on a client's network before someone else carries out the real one. At SNOK we also help with [NIS2 and DORA compliance audits](https://snok.ai/en/offer/sap-security/nis2-dora-audit/), with [cybersecurity services](https://snok.ai/en/offer/cybersecurity/) and with [securing AI deployments](https://snok.ai/en/offer/ai-automation/ai-security/). In August, in [Quo vadis, engineer?](https://snok.ai/en/news/blog/quo-vadis-engineer/), I asked where AI is taking our profession. Today I am putting the same question to the technology itself, and the answer depends more on us than on it. ## Sources - [CERT Polska - Critical vulnerabilities in PHP allowing remote code execution (21.10.2026, in Polish)](https://moje.cert.pl/komunikaty/2026/195/krytyczne-podatnosci-w-php-umozliwiajace-zdalne-wykonanie-kodu/) - [CISA - Critical Vulnerabilities in PHP Require Immediate Patching (21.10.2026)](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching) - [Euronews - Websites go dark after AI exposes major programming language security flaw (22.10.2026)](https://www.euronews.com/2026/10/22/websites-go-dark-after-ai-exposes-major-programming-language-security-flaw) - [Rzeczpospolita - Millions of websites at risk, governments shut down services (22.10.2026, in Polish)](https://cyfrowa.rp.pl/it/art45376571-miliony-stron-internetowych-zagrozone-rzady-wylaczaja-serwisy-luki-pomogla-wykryc-ai) - [CISA - CISA Adds Two Known Exploited Vulnerabilities to Catalog (26.10.2026)](https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog) - [SecurityWeek - China-linked hackers exploit PHP2Shell to root firewalls (28.10.2026)](https://www.securityweek.com/china-linked-hackers-exploit-php2shell-to-root-firewalls/) - [Wiz - PHP2Shell: exploitation so far (27.10.2026)](https://www.wiz.io/blog/php2shell-exploitation-so-far) - [Tenable - PHP2Shell frequently asked questions (21.10.2026)](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote) - [Anthropic - Claude Mythos Preview (7.04.2026)](https://www.anthropic.com/research/mythos-preview) - [Anthropic - Expanding Project Glasswing (06.2026)](https://www.anthropic.com/news/expanding-project-glasswing) - [Bruce Schneier - Anthropic's Project Glasswing Update (06.2026)](https://www.schneier.com/blog/archives/2026/06/anthropics-project-glasswing-update.html) - [Anthropic, PBC - registration statement, Form S-1, SEC (26.10.2026), Risk Factors pp. 26-119](https://www.sec.gov/Archives/edgar/data/2130357/000162828026067168/anthropicpbc-sx1.htm) - [Anthropic - Disrupting the first reported AI-orchestrated cyber espionage campaign (13.11.2025)](https://www.anthropic.com/news/disrupting-AI-espionage) - [Ministry of Digital Affairs - Cyberattack on Polish energy sector infrastructure, CERT Polska report (30.01.2026, in Polish)](https://www.gov.pl/web/cyfryzacja/cyberatak-na-infrastrukture-sektora-energii-w-polsce-opublikowano-szczegolowy-raport-cert-polska) - [The Register - Cloudflare coughs, half the internet catches a cold (18.11.2025)](https://www.theregister.com/2025/11/18/cloudflare_outage) - [InfoQ - analysis of the AWS us-east-1 outage of 20.10.2025 (11.2025)](https://www.infoq.com/news/2025/11/aws-disruption-cloud)