# AI Is Not Coming for IT Jobs. We, the IT Pros, Are Way More Efficient at Killing Them Ourselves > PHP2Shell and a Node.js RCE landed on the same day. The patches were the easy part. What failed was us - the hype, the overconfidence, the "relax :)". - Canonical URL: https://laskov.dev/posts/php2shell/ - Published: 2026-10-22T00:00:00.000Z - Author: Hristo Laskov - Section: SECURITY - Keywords: security, php, laravel, nodejs, incident, ai - Tags: security, php, laravel, nodejs, incident, ai - Site index for agents: https://laskov.dev/llms.txt --- For the past couple of years I have been really enjoying the debate about how AI is going to kill, replace, obliterate and eliminate programmer jobs. As if we are doomed. No more bread for us. Some people even gloat about it, openly and directly, as if we are all about to starve. I have seen it, and I have heard it. Yesterday showed me something else. AI is not what will eliminate these jobs. **We are screwing ourselves over, with our own incompetence, or with an overconfidence so complete that we have forgotten ourselves.** That last one will cost us our health. And it will kill a lot of jobs. A lot of jobs. ## Two RCEs, one punching bag On October 21 both runtimes my team lives on shipped fixes for remote code execution. PHP disclosed [PHP2Shell](https://www.wiz.io/blog/php2shell-php-rce), CVE-2026-109618 and CVE-2026-109619, reaching back to PHP 5.4 and [exploited in the wild the same day](https://watchtowr.com/intelligence/php-cve-2026-109618-faq/). Node.js shipped its [October security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases), including CVE-2026-111497, an out-of-bounds write in the Brotli decoder. Also remote code execution, rated lower, but still RCE. Guess which one the internet talked about. PHP broke the internet, and a big part of the industry spent the day commenting on PHP as a language. How bad it is. How dumb. How it should have died years ago. Meanwhile the other runtime had an RCE of its own, and almost nobody had an opinion about JavaScript. PHP is a wonderful language. It runs a huge share of the web, and Laravel is why it still feels like a first choice rather than a legacy one. The ecosystem did the work while everyone else did the talking: [Laravel News](https://laravel-news.com/php-critical-rce-security-releases) had per-product guidance up the same day, and Laravel Cloud patched running apps in place. Dead languages do not light up every security feed on the planet. ## Commentary is not work What struck me most was how many people got busy explaining instead of doing their job. The job yesterday was simple to describe. Watch the logs. Patch. Solve the problems of the people who depend on you. None of that happens in a comment thread. Our own day looked like this: - **Laravel Forge was down** exactly when we needed it. The "Update PHP" button is great until the panel behind it stops answering. We had every machine updated by this morning, almost 24 hours after disclosure. - **The official Docker images** picked up the new versions 3-4 hours after release. Normal? Probably. For a bug exploited on day one, 3-4 hours is still an open door. Know how to patch without the vendor's panel. SSH, package manager, restart. Write it down before the day you need it. ## Relax is not a security posture This is the exchange that stuck with me. Translated: > **Me:** Hi, we have signals it is already being exploited freely. I suggest we cut > traffic from Africa and Asia as a preventive measure until patched builds land. > > **A client's contractor:** Relax :) That was the whole reply. The other one I heard more than once: "I have applied the mitigation." There are interim settings that reduce exposure, such as limiting request sizes at the proxy and turning off session upload progress. None of them closes the hole. The advisory says it plainly: updating PHP is the only complete fix. "Mitigated" was used to mean "done". It was not done. ## Code is a utility Programming is not writing code. Code is a utility, like water or electricity. It is a means to an end. A huge part of us forgot that, especially the ones with agents at hand. We forgot what the mission is: to solve problems by means of code. Not to produce code. Not to have the cleverest stack. To solve problems. So instead of growing what we already have, we rushed to rewrite everything in Rust. Instead of taking the system that works and developing it to solve more problems, we started over, so we could solve the old ones again in a newer syntax. The language was never the point. Yesterday the PHP shops that patched fast were fine, and the Node.js shops that did not were exposed. The runtime did not decide that. The people did. ## The best bug is a new one What we should be doing is building on what we have until it solves more problems, and until it starts creating new ones for us to solve. Because in the end, the greatest achievement of a programmer is to see a new bug. A different one. Not the same one as before. AI is not coming for your job. We, the IT pros, are way more efficient at killing it ourselves.