Perplexity turns PHP2Shell into a free vulnerability-scanning skill as Cloudflare counts millions of exploits
From the AI digest for 2026-10-22
What happened: Perplexity CEO Arav Srinivas announced on 22 October 2026 (~11:41 AM US Eastern) that Computer's new PHP2Shell skill "checks your PHP sites and GitHub deployment configs for exposure, then prioritizes fixes." Tasks using /php2shell-exposure-check are free through 31 October 2026, capped at 5,000 credits per user, and the skill is listed live in the skills marketplace for all Computer users. The same window carried the threat the marketing leans on: Cloudflare CEO Matthew Prince's stat line, reposted by a platform maintainer (~9:25 PM US Eastern on 21 October 2026), put exploitation attempts across Cloudflare's network at thousands in the ten hours before PHP2Shell was publicly announced, tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours — and millions now.
What's genuinely new: Two deltas in one item. On the agent-harness thread it is a development of the /graphify debut from 21 October: this second skill adopted the identical trial-credit structure — a time-limited free window with a 5,000-credit per-user cap — within a day, turning what looked like a one-off promotion into a repeating go-to-market playbook for Computer's skills marketplace. On the security beat it is the sharpest move: Perplexity productized the PHP2Shell disclosure OpenAI and Google DeepMind announced on 21 October 2026 into an end-user scanning service on another company's agent platform, inside 24 hours of the announcement — while Cloudflare's figures show the mass-exploitation aftermath is real, millions of attempts strong.
Watch: whether the free-trial structure hardens into the marketplace's default skill-launch formula; whether Perplexity publishes scan volumes or adoption counts; whether exploitation traffic decays as the disclosure-window fixes propagate.