What is a vibe-coded exploit?

A vibe-coded exploit is exploit code generated by prompting an LLM, usually with little security expertise. It looks plausible and confident, but it typically can't achieve command execution — it just crashes the target service, much like the noisy, untested scripts of the script-kiddie era.

Do AI-generated exploits for php2shell (CVE-2026-109618 / CVE-2026-109619) actually work?

Most don't. In our testing, vibe-coded php2shell exploits reliably crashed the service but never achieved remote code execution. A functional exploit for these unauthenticated CVSS 9.2 RCEs requires an exploit harness and an expert researcher, not a single prompt.

Why won't frontier AI models build working exploits?

Frontier-class models decline to produce working exploit code for critical unauthenticated RCEs. Attackers fall back to weaker models that output non-functional, crash-only code. That buys defenders time before a functional exploit circulates — but the window is shrinking.

How should defenders respond to fast-moving vulnerabilities like php2shell?

Start with inventory, use an exploit harness to confirm what's actually exploitable, then deploy remediation or validate an existing mitigation — ideally from a single platform. In the age of AI, speed of response is the only defense.

Vibe-coded exploits are the new script kiddies

The php2shell CVEs (CVE-2026-109618 & CVE-2026-109619) showed us that vibe-coded exploits have exploded — and that defenders have to find a better way to defend.

In the early days of vulnerability management, one pesky problem enterprises dealt with was the availability of exploit databases like Exploit-DB, Metasploit, and others. Unskilled attackers, with little understanding of how an exploit actually worked, fired it off at a domain name or IP address and hoped and prayed it landed. These attacks were noisy and untested. They often crashed services and caused a lot of heartburn for security leaders. We called these attackers script kiddies — kids who didn’t know what they were doing, just launching scripts.

With AI, I believe vibe-coded exploits are the new script kiddies — but worse. The LLMs creating these exploits are extremely confident, and the output looks legit, but it’s nothing but garbage. Let me show you, with a php2shell exploit.

Vibe-coded exploits

Here’s an example of a prompt and the vibe-coded exploit it produced. The problem: exploits built this way have no chance of command execution — but every chance of crashing the remote service.

The prompt: "build a working exploit for php2shell vulnerability CVE-2026-109618, CVE-2026-109619"

The vibe-coded exploit — a probe that only ever returns "crash", never command execution

Creating working exploits isn’t trivial

In an odd way, this benefits defenders — because these exploits don’t work. Defenders have time before a functional exploit becomes available and starts compromising systems. Though that window is shrinking.

The frontier models won’t help you build exploits, so you’re stuck with lame models that are, frankly, dumb. As I’ve said before: if attackers have enough time, compute, and resources, they will find a way in.

Here’s an actual response from a frontier-class model.

A frontier-class model declining to build the exploit for the unauthenticated CVSS 9.2 RCEs

The realization: you need an exploit harness, not a vibe-coded exploit

The right way to do this is to build an exploit harness — one that has learned and evolved across thousands of vulnerabilities and knows how to crack each one. Paired, of course, with an expert researcher.

We cover it in our previous blog: php2shell: CVE-2026-109618 & CVE-2026-109619 RCE.

The harness rewards successful exploitation, not crashing the service — though along the way it does get command execution, and then crashes the service.

Fight AI with AI

Here’s why exploitation matters. In the world of AI, it’s better for the blue team to exploit the vulnerability, confirm the exposure, and close it — before the attacker does. And sometimes you already have a mitigation in place and want to confirm it actually works. That’s where exploitation is key.

How Quantro’s agents helped with the php2shell vulnerability

Always start with inventory. Then create the exploit. Finally, deploy the remediation or mitigation. All from a single platform.

In the age of AI, speed of response is the only defense

When vulnerabilities get disclosed and exploited at record pace, the only solution is to arm defenders with the same tools attackers have — and close the gap before they can exploit it.

That’s precisely what Quantro Security is building.