---
id: "lib-2026-10-22-we-can-now-find-flaws-faster-than-anyone-can-fix"
type: "library"
title: "We can now find flaws faster than anyone can fix them"
lang: "EN"
org: "Tolmo"
source_type: "Practitioner post"
date: "2026-10-22"
week: "2026-W43"
url: "https://nosov.ai/library/lib-2026-10-22-we-can-now-find-flaws-faster-than-anyone-can-fix/"
original_url: "https://tolmo.com/blog/faster-than-anyone-can-fix-them/"
tier: "B"
tier_name: "Useful, limited"
tier_reason: "A first-hand account from an auditor on the 2024 PHP audit, with a concrete re-measurement of how close his finding was to PHP2Shell; useful and candid, but the AI speed-up is one anecdote and the author's firm sells security agents."
summary_basis: "full-text"
original_minutes: "11"
tags: ["ai security", "vulnerability remediation", "disclosure"]
---

# We can now find flaws faster than anyone can fix them

Tier B (Useful, limited): A first-hand account from an auditor on the 2024 PHP audit, with a concrete re-measurement of how close his finding was to PHP2Shell; useful and candid, but the AI speed-up is one anecdote and the author's firm sells security agents.

Summary based on the full text.

## In short

A 22 October 2026 essay by Mihail Kirov, now at Tolmo, previously one of five Quarkslab auditors on the 2024 OSTIF-commissioned audit of PHP's core. The audit reported two flaws in exactly the code behind PHP2Shell; one was filed as a crash (denial of service) and given a CVE identifier that stayed unpublished for two years. Re-testing the 2024 case, he found the serious version was three small changes away, visible only on a server setup outside the audit's scope. His point: finding a flaw and proving its worth used to be one expensive activity, and AI tooling has split them.

## Key numbers

- 57 days: length of the 2024 Quarkslab audit of PHP's core by five auditors
- 923: extra filler characters, with a three-character input change and another server setup, separating the 2024 crash from the serious defect
- 263%: rise in vulnerability submissions between 2020 and 2025, as cited
- more than 20,000: unprocessed entries in the US National Vulnerability Database backlog, as cited

## What it reports

- 2024 audit: 57 days, five auditors, no fuzzing because "setting up the necessary environment proved too complex within the given timeframe". Both findings were blanked in the published report pending complex fixes.
- The team tested on PHP-FPM, which kills the process on the crash and hides the damage; the other common setup (Apache with mod_php) keeps the process alive with corrupted state.
- Distance to the serious defect on 2024 software: a three-character change to the trigger, 923 extra characters of filler, and the other server setup.
- In August 2026 two organisations reported the same root cause on the same day, after it sat unfixed for 26 months; a third followed two weeks later.
- His re-examination took a day with current AI tooling, against a week he did not have in 2024.
- Cited context: submissions up 263% between 2020 and 2025; NVD backlog over 20,000, and NIST moved to risk-based enrichment in April 2026.
- Five assumptions he says no longer hold: holding a finding keeps it private; "no known exploit" describes the bug; maintainers control the disclosure date; an identifier informs defenders; discovery is the bottleneck.
- Recommendations: fund fixes along with audits, give every deferral an expiry date and owner, pre-stage emergency releases, publish identifiers even without details, and verify CDN stopgaps from outside.

## How they got it

Personal recollection backed by the published audit report and the PHP Foundation's post-mortem, plus a re-run of the original 2024 test case on 2024 software.

## Limits

- The day-versus-week comparison is a single anecdote with no breakdown of what the tools did.
- Volume figures are cited without links to method in the text read.
- Tolmo sells pentesting and remediation agents, so the "discovery is cheap, fix capacity is scarce" framing aligns with its market.

## Why it matters for companies

The practical lesson is about deferred risk: a known, unexploitable-for-now bug is a liability whose cost of exploitation keeps dropping. Security and risk owners should put expiry dates and named owners on every deferred finding, budget remediation when commissioning audits, and verify vendor mitigations from outside rather than accepting "deployed". The account also shows how audit scope (one server setup) can hide severity.

Original: https://tolmo.com/blog/faster-than-anyone-can-fix-them/