Ready or Not, Here Comes AI: AI or Die, Part Two

TL;DR

• In one week in October 2026, critical remote-code-execution bugs landed in PHP, NGINX, Node.js, Linux and BIND. PHP2Shell was being exploited four days before anyone disclosed it.
• The same week, US banks found AI agents inside customer accounts, some acting on nobody's instructions.
• The window between "bug published" and "bug exploited" collapsed from months to hours. Humans cannot patch at that speed. Agents can.
• The question is no longer should we adopt AI. It is are we ready for what AI already did.
• Ready means: know what you run, patch in hours, monitor in minutes, review every endpoint before it goes public, and put agents on defense.
• I will not tell you we are safe. Nobody is. I will tell you what ready looks like.

Last time it was about money

In June I published AI or Die. The argument was commercial: AI reset the floor for content tools, "a place to publish" became a commodity, and the only way out was to rebuild the CMS into an agentic platform where agents start the work and people approve it.

I stand by every word. I also thought we had time. Years, maybe. A slow squeeze on margins, the kind you can plan around.

Then came the week of October 14.

Seventy-two hours

Here is what landed, in order.

• October 14. Three critical vulnerabilities in NGINX, the web server in front of most of the internet. Remotely exploitable, no login required.
• October 17. Amazon's threat intelligence sees the first exploitation attempt against a PHP bug that nobody had disclosed yet.
• October 20. The PHP identifiers and a proof-of-concept video leak.
• October 21. PHP ships the fix a day early. "PHP2Shell", two bugs, unauthenticated remote code execution, broadly exploited by the time the patch exists. The same day Node.js ships 10 security fixes including a remote-code-execution bug in its compression library. The same day ISC discloses a remote-code-execution bug in BIND, the DNS server half the internet resolves through. Reports of a compromised certificate authority circulate on top.
• October 22. Axios reports that Morgan Stanley, JPMorgan, Bank of America and Wells Fargo are detecting unauthorized AI agents operating inside customer accounts. Some of those agents appear to take actions independent of what the user asked. Morgan Stanley starts blocking third-party agents outright. One executive's word for it: horrifying.

The WordPress world is on fire as I write this. Not because WordPress itself is uniquely bad, but because a typical WordPress site carries forty plugins written in old PHP that nobody maintains. You cannot patch what nobody owns. You rebuild it or you delete it.

At RebelMouse, every production Node.js image we ran was behind the patch that morning. I am telling you that on purpose. Everybody was. The difference is what happened next, and I will get to it.

The part nobody wants to say out loud

Bugs like these did not appear last week. Some of them have been sitting in that code for a decade. What changed is who is looking.

The PHP bugs were found by researchers working with OpenAI's models. The BIND bug was found by an OpenAI researcher. On the other side of the line, the volume, the speed and the way the targets chain together do not look like humans with scanners. They look like agents running on a model with no guardrails. My speculation, and I label it that: an unrestricted model, the kind that is restricted in the United States, which means defenders here cannot use it and attackers elsewhere can. Even if I am wrong about which model, the pattern holds.

Attackers moved to agents. Most defenders did not.

Here is what that does to the math. For 20 years the industry ran on a quiet assumption: a vulnerability gets published, the exploit takes weeks or months to appear, you patch somewhere in between. I remember the jQuery years. A cross-site scripting bug gets reported, you install the new version, you are "safe" because nobody has found the hole in the new version yet. Next release, same bug, new place. It worked because the window was months long and you only needed to be inside it.

That window is now hours. Sometimes it is negative: PHP2Shell was exploited before it was disclosed.

In that world the old advice still applies, with one change. You do not need to outrun the bear. You need to outrun the other guy. The other guy is now an agent.

"Would you like to adopt AI" is the wrong question

In June the pitch was: adopt AI and your team produces more. Fair, and still true. But the frame was opportunity. You could say "not yet" and lose some margin.

Not yet is gone. If your patch process is a change ticket, a weekly maintenance window and a human reading changelogs, you are not slow. You are absent. The agent on the other side does not wait for your Tuesday deploy.

So the question for every publisher, every agency, every platform is no longer whether they would like to adopt AI. It is whether they are ready for what AI already did to the ground under them.

Ready or not, here it comes.

What ready looks like

This is the part we lived this month, not the part we plan to live. The full playbook is, like last time, a longer conversation. Here is enough to know if you need to have it.

1. Know what you run, in minutes, with evidence. When the Node.js advisory landed before 7 a.m., the first question was not "how do we patch" but "what exactly do we run". We answered it by reading the configuration of every production image in our registry: which Node version, which base image, which services decompress untrusted input. About 175 workloads, mapped before most people were awake. When the BIND advisory came the next day, it took 20 minutes to prove we were not exposed: DNS is managed by AWS, nothing in our clusters runs BIND, nothing uses the feature the bug needs. Proof, not a guess. If you cannot produce that list in an hour, start there.
2. Patch in hours, not sprints. Within the hour of the Node.js advisory, pull requests were open in every affected repository. An agent found them, matched the pinned versions, rewrote them and opened the PRs. Humans reviewed and merged. Standing rule now: a patch PR is the top item in anyone's queue, and one named engineer has authority to patch production the day a fix ships, with no change ticket. Every vulnerability report is an emergency. No triage debate first.
3. Monitor in minutes. Vendor advisories, CISA's exploited-vulnerabilities list, GitHub alerts and our image scanner go into one channel, and agents match every entry against the inventory from step 1. False positives are fine. Finding out from a customer is not.
4. Nothing public without a review of every endpoint. Every valid finding our bug bounty produced this year was the same shape: a new endpoint, shipped fast, with an authorization gap. Not exotic. Not clever. Just unreviewed. So the rule is now mechanical: a new API or agent endpoint gets an authorization review before merge, and our self-serve sign-up is invite-only until this wave passes.
5. Agents on defense. A human team cannot patch at the speed an agent can exploit. So the last piece is the one the title is about: agents that review code before it deploys, agents that watch traffic after, agents that read advisories and open the fix before a person has finished the coffee. We have applied to the cyber-defense programs the model vendors opened this month. The only thing that matches an agent is another agent.
6. Tell your customers the same day. Not "we are the safest." Nobody who says that is. What happened, what you run, what you did, what they must do. In plain words, and before they ask.

In June the agentic platform was about output. In October it turned out the same platform is the one that can defend itself. A site that knows why it exists also knows what it runs, and a workforce of agents that writes the work can also patch the work.

What this means if you publish for a living

Most media companies I talk to are on WordPress or something like it, with a plugin stack nobody fully owns and an agency that patches when the retainer allows. In June that was a cost problem. This month it is a survival problem. The question to ask your team this week is not "are we patched?" It is "how long after an advisory do we know whether it applies to us, and how long after that are we fixed?" If the honest answer is measured in days, you are relying on luck, and the luck just ran out.

The move is the same one we made, in the same order: inventory, hours-not-weeks patching, monitoring, review, agents. A platform that runs the work for you should also be the one that keeps the work standing. That is the conversation we are having with every client right now, and it is the one I would rather have before the next advisory than after.

What the humans are for, revisited

In June I asked: if the work runs itself, what are the humans for? The answer then was taste and judgment.

October added one more: deciding what is an emergency. Every step above has an agent doing the fast part and a person making the call. An agent found 16 repositories; a person decided they ship today. An agent proved BIND did not apply; a person decided to stop looking. That is the same inbox I described four months ago. Approve the thing, or send it back. The thing is now a patch, and the deadline is set by someone else's agent.

We are still in the loop. We are just not the bottleneck anymore. That is the whole point.