Token Security highlights blast radius over CVSS score after PHP2Shell exploits

Attackers can exploit critical flaws like PHP2Shell before organizations even have time to apply security patches, highlighting that limiting the permissions of service accounts, API keys, and AI agents is just as crucial as fixing bugs to minimize potential damage from a breach.

The discovery of two remote code execution flaws in the language underpinning 69% of the web, aided by OpenAI and Google models, shows how rapidly exploitation can occur; attackers targeted these issues before the official patch was even released. This situation makes a strong case for application security vendors, as PHP2Shell is poised to become the most compelling budgetary argument for these companies in years.

Researchers at Calif and Wiz uncovered these two vulnerabilities in August, jointly disclosing them with OpenAI, and Amazon noted an attempt to exploit them on October 17, four days prior to the disclosure. The patch was released by PHP on October 21, and watchTowr observed active exploitation attempts that very same day. Following this, Cloudflare noticed attack traffic intensifying rapidly after the disclosure, and CISA added both flaws to its list of known exploited vulnerabilities on October 26.

It is now frequently the case that exploitation commences prior to public disclosure. Regrettably, the pace of remediation lags significantly behind this speed. Verizon’s 2026 DBIR indicates that the median time required to fix a vulnerability known to be exploited is 43 days. Furthermore, Qualys reports that the average time for remediation stands at 21.2 days, and a substantial 63% of critical vulnerabilities remain unaddressed even after a week. All of this happens while nearly 195 new CVEs are published daily. The PHP2Shell situation suggests that cleanup will take longer than the average. This is compounded because PHP is embedded within appliances and hosting control panels that customers lack the ability to update themselves. Additionally, official builds for versions 8.1 and older were never provided. As of October 27, Censys documented 32.5 million internet-facing PHP services still operating with potentially vulnerable versions, alongside over 60 million others that fail to report a version number whatsoever.

Regardless of the approach taken, the speed of fixing issues will likely remain slower than the speed of exploitation in the near future, even when AI-driven workflows significantly aid in patching. Agents now operate across your infrastructure with access levels that nobody has thoroughly reviewed. Token Security’s AI Agent Security tool helps pinpoint every agent, associate it with an owner, and restrict its capabilities.

With the gap in exploitation widening, the temptation exists to dedicate all resources to slowing the advance. However, even if an AI-driven scan unearthed 2,000 novel zero-day vulnerabilities in your environment tomorrow, this would only yield a list, not a genuinely stronger security posture. Some identified issues would be simple to fix, while others would demand more time than your team possesses. For supported PHP branches, the straightforward remedy was installing the updated release. Nevertheless, governments and corporations often chose to take their websites offline while awaiting this patch.

A more optimistic perspective suggests that while vulnerabilities lead to exploits, and exploits lead to attacks, the true impact within an enterprise setting is determined by the reach of the compromised identities. A shell gained on a PHP server grants the attacker access to everything that server can read, ranging from environment variables to cloud keys stored in configuration files. Moreover, PHP2Shell possesses the capability to leak worker memory, which can contain passwords, tokens, and API keys. An attacker gaining code execution on one machine effectively opens a door to a hallway, but the truly valuable assets are typically secured within locked rooms. The controls that prevent movement across the network do not rely on winning a race against discovery. Identifying vulnerabilities is an endless process, whereas limiting the scope of a service account is a measurable task.

This identity-centric approach does have its limitations: if the vulnerability resides within the Identity Provider or the secrets manager, the ability to move laterally is already inherent. Similarly, if the flaw is in the database or the storage provider, the attacker is already positioned where they wish to be. Given limited resources, the instinct might be to remain vulnerability-first: to document what advisories and scanners have found, prioritize those findings, and work down the list. Yet, cataloging can consume weeks, and resolving the most urgent findings requires even more time. The underlying assumption here is that the most easily exploited gaps in your core systems are the ones you should address first. This assumption prioritizes the severity of the vulnerability (the CVSS score) over the potential blast radius. Attackers are not seeking the most direct route; rather, they look for the path of least resistance. Moving with a stolen credential is simpler than constructing a chain of zero-days to reach a database directly.

October’s other security news illustrates this point: at LiteLLM, attackers utilized a master key exposed in a public repository to obtain an unscoped GitHub organization-owner token from an internal agent platform. This identity allowed them to steal two additional maintainer tokens, tamper with the release workflow, and publish artifacts designed to steal credentials. You cannot win the race to patch every single server before the threat actors arrive, but you absolutely can determine the value of a compromised server to them. The recommended action is to discover and inventory every non-human identity and AI agent, beginning by securing those with the widest reach. Assign an owner, restrict access according to the intended purpose, eliminate dormant credentials, and maintain continuous governance over the identity lifecycle. For AI agents specifically, extend this by granting access based on intent. This is the essence of treating identity as the control plane. Patching dictates how swiftly you seal a breach; identity determines the extent of damage an attacker inflicts when patching proves impossible.

To learn more from Token Security, arrange a technical demonstration with their team. This content was sponsored and written by Token Security.

Why it matters

For working developers, this highlights that vulnerability scanning alone is insufficient against modern threats. Controlling the blast radius through identity management is a necessary countermeasure to the speed of exploitation. Security teams must prioritize limiting what a compromised workload can access.