# AI cut attacks that took months to 20 minutes

_AI cut full exploit chains to 20 minutes, and Black October proved it on PHP servers with no login._

**Published:** 2026-11-13
**Source:** https://www.startuphub.ai/ai-news/technology/2026/ai-cut-attacks-that-took-months-to-20-minutes

---

Before Mitos, the best attackers needed weeks or months for a full chain. Now AI runs the same attack in about 20 minutes. The target on [a16z](https://www.youtube.com/watch?v=PbD9pVXxsYM) was PHP servers facing the web, with no login required.

Mitos proved models could find bugs. The accidental [OpenAI](/startups/openai) attack showed risk at scale. Black October made both real, said Ami Luttwak, Wiz co-founder and CTO. His team counted 9 hit AI development platforms, then 15 within days.

Speed is the break. Luttwak said models "are good enough now to find and exploit complex vulnerabilities" and open models closed the gap to about three months, letting low skill actors hit API mistakes as well as PHP flaws.

Patching has not kept pace. About 50% of Wiz customers patched PHP in two to three days, yet PHP powers about 70% of the web. [Qualys](https://blog.qualys.com/vulnerabilities-threat-research/2026/10/20/php-announces-critical-security-release-for-two-vulnerabilities) reported the pair as CVE-2026-109618 and CVE-2026-109619, each at CVSS 9.2 for unauthenticated remote code execution. Older PHP has no fix at all.

Wiz now tests frontier models continuously against critical code. The next test is its Zero Day competition, with multiple teams already reporting the same critical flaw.

---

Original analysis from [startuphub.ai](https://www.startuphub.ai), the #1 AI startup directory.

© StartupHub.ai. All rights reserved. You may not republish this article in full without a license. Search engines and AI research tools may crawl and summarize for reference. Bulk reproduction or model training on this content requires a license. See https://www.startuphub.ai/terms.