There are no longer any locked doors on the internet. You need to keep watch if you want to keep your product safe.
Yesterday on October 21st, 2026, two major PHP vulnerabilities were made public that allow attackers to remotely execute arbitrary code without authorization. Hacker can exfiltrate data, update authoritative content, or simply highjack compute resources. Cloudflare CEO Mathew Price reported their global network saw millions of attempts to exploit the vulnerability. The Japanese prime minister herself issued a warning to patch the PHP websites. Even the NSA even suggested taking PHP powered systems offline. It’s a nightmare scenario. A massive portion of the internet is built on PHP, and we'll be dealing with the fallout from this exploit for a long time.
This was just one of several critical vulnerabilities and hacks made public yesterday.
Vulnerabilities like this don’t appear out of thin air, they exist harmlessly and are one day discovered. Thousands more exploits likely exist in the open source frameworks that underpin the internet, and that’s before we start to unpack the closed source software powering our digital infrastructure and products. Hacks this massive didn’t used to happen this frequently because each one used to take a lot of time, effort, and ultimately luck to find. The PHP exploit sat dormant for over a decade!
Not anymore. AI tooling is capable and cheap enough for amateur hackers to discover and exploit these problems at scale without deep expertise. The PHP exploit was discovered with the prompt "find bad vulnerabilities in PHP”. With the release of open weight models GLM 5.3 and DeepSeek V4.1 Flash, both with frontier ability on cybersecurity tasks, any motivated person, company, or nation state can hack away.
There will be a tsunami of new critical vulnerabilities, and cybersecurity needs to become a core competency of every team. The background noise of the internet is about to get a lot louder, and we need to be prepare to counter it.
Exploit Factories
“Software Factories” have been all the rage this year: AI powered workflows that automatically create, test, and deploy product improvements. Built correctly, a software factory removes menial work from software engineering and allows teams to dramatically increase their development velocity.
A similar pattern is coming to cybersecurity: the “Exploit Factory”. Where software factories create software, exploit factories will manufacture exploits by aggressively probing your own product as if it were an attacker. When it finds vulnerabilities, it suggests patches to fix them up. Ideally, they'll pass the suggestion right to your software factory.
With abundant and capable intelligence, hackers will be probing your system 24/7. Your exploit factory needs to be proactive, accurate, and fast. Overall, it needs to match the speed and scale that your software factory generates improvements, so nothing falls behind.
Products are continuously improved by software factories, and aggressively probed by an exploit factory. Software factories enable high engineering velocity, and exploit factories need to keep pace as the system evolves.
Build Your Factories
Every engineering team will need in two factories:
- A software factory: turn instructions into durable, tested, production code.
- An exploit factory: continuously probe and patch vulnerabilities in your product to protect your product from the agent hoard.
Today there are hundreds of harnesses and products to build software factories, but few intentionally designed exploit factories. Among the options, I’d recommend using Amplify Security, a harness built explicitly for cybersecurity work, or for more flexibility Nori, a configurable platform for durable cloud agents.
Subconscious, our own inference system designed for long-horizon agents, is a perfect fit to power your exploit factory. Exploit hunting performs best with open models that don’t refuse requests, and workloads consume far beyond the 200k token threshold where our infrastructure thrives. Our flagship GLM 5.3 Marathon model allows for frontier exploit hunting, with faster discovery, lower cost, and better performance than GLM 5.3 hosted elsewhere.
Start building your exploit factory today, the agents are coming. Use the Subconscious with your favorite coding harness, or choose us to power your agents directly in Amplify or Nori.
I credit Hari, the CEO of Cantina Security, for saying the phrase “Exploit Factory” in this post.
