Security research has a discovery problem. Most critical vulnerabilities sit dormant in codebases for months or years before anyone finds them — not because they're hidden, but because manual code review doesn't scale.

The PHP2Shell disclosure changed that calculus.

What the Numbers Actually Mean

When Wiz Research used AI to find CVE-2026-109618 in roughly one week, the real story isn't the CVE — it's the time compression. A team of three senior security researchers, working manually, would typically spend 4–8 weeks to reach the same result. AI didn't replace the researcher. It multiplied their output by 10x.

How the Triage-Pattern-Exploit Loop Works

The methodology Wiz used isn't proprietary magic. It's a reproducible loop:

  1. Ingest the entire codebase — not just the files you think matter, but everything
  2. Apply historical CVE patterns — use prior bugs in the same codebase as fingerprints for similar flaws
  3. Rank by exploitability — not all memory bugs are equal; AI sorts them by proximity to input surfaces
  4. Generate a candidate exploit chain — let the model show the attack path before a human validates it

This loop works because most CVEs in mature codebases share structural DNA with prior CVEs in the same project. PHP's zend engine has had multiple use-after-free bugs. Each one is a training signal.

The Gap This Creates

Organizations that adopt AI-assisted security discovery don't just find bugs faster — they find bugs their competitors haven't found yet. In the current threat environment, that asymmetry is everything.

The attacker community is already using these tools. The question is whether defenders will close that gap or continue relying on annual pen tests and manual code reviews that can't keep up.

What Autonomous Remediation Adds

Discovery is only half the problem. The other half is remediation velocity. When a CVSS 9.2 CVE drops with active exploits in the wild, the organization with autonomous patching deployed wins. The one that kicks off a two-week change management process loses.

Cognitive Daniel is built on exactly this principle — autonomous AI that doesn't just find vulnerabilities but patches them across entire fleets, with zero manual intervention per server.

Full writeup: cognitivedaniel.com