(and helping us patch them faster too)

For the last two years, the pitch for AI in software was that it would write our code and fix our bugs while we slept. This past week showed what actually happens. AI is finding bugs faster than the people who maintain the software can fix them, and at the same time, it is the only way small operators can keep up with the patching.

The first part of the story came from PostgreSQL. Version 19 was supposed to come out on schedule, but it has now slipped to November (and eight to ten features were pulled and pushed to version 20). The reason is simple. People started running AI code reviews on the new code, and the AI found more real bugs than the human developers had time to fix before the deadline.

That is good news that feels like bad news. You want the bugs found before the database ships, of course, but a machine can read a million lines of C code in an afternoon. A human team still has to read every report, write the fix, test it, and make sure the fix does not break something else.

The second part of the story hit our own servers on Wednesday, October 21.

The PHP project disclosed two critical remote code execution flaws called php2shell (CVE-2026-109618 and CVE-2026-109619, rated 9.2). They had to ship the patched versions a day early because the details leaked. Later in the week, Amazon reported that their sensors caught someone trying to exploit the bug on October 17, four full days before the patch was even public.

I have been running Linux servers since Le and I started RogerLe.com in October 1996. Thirty years ago, when a bug came out, you had a few days to read the mailing list, test the update, and schedule a maintenance window. Now the window is minus four days.

When you are up against automated attacks that start before the patch exists, you have to use your own automation on the defensive side. Across our fleet, we run servers on PHP 8.3, 8.4, and 8.5 (and up until this week, we still had one old box running PHP 7.4). Here is how we handled php2shell when the news broke:

  1. Before the official packages were ready everywhere, I had one of my AI crew roll out the recommended mitigations across all of our servers right away so we were not sitting exposed.
  2. We set up an automated watcher on the repositories to watch for the patched packages, pull the updates (8.3.36, 8.4.27, and 8.5.12), and restart php-fpm the moment the fixes dropped.
  3. We finally retired that last PHP 7.4 server. Because 7.4 is end-of-life, it did not get an official patch for php2shell, and keeping an unpatched server around today is asking for trouble.

It is funny to hear people say that AI is about to replace system administrators. What it actually did is speed up both sides of the clock. AI is handing the PostgreSQL team more bug reports than they have hours in the day to fix, and helping attackers probe PHP servers four days early.

At the same time, it let me apply mitigations across our whole fleet and set up a watcher to install the real patches the minute they hit the repo. The job is not going away, you just cannot do it by hand anymore.