On October 21, 2026, two critical vulnerabilities, PHP2Shell (CVE-2026-109618 and CVE-2026-109619), were publicly disclosed. Both are rated 9.2 and both allow remote code execution on vulnerable servers. Government portals, public services, and commercial sites across multiple countries went offline as a precaution while teams rushed to patch.
But the flaws were known on October 20, and the patch didn’t ship until the 21st. That gap is where attackers operate, and it raises the question every security team is asking: how do you protect systems when the vulnerability is known but the fix isn’t here yet?
Where signature-based protection runs out
Traditional WAFs rely, at least in part, on signatures. That makes them predictable, but it also builds in a delay. Someone has to analyze the exploit, write the rule, and ship it, and in many cases customers still have to take manual steps before they’re covered.
And what if an exploit circulates before your vendor updates? What if the attacker tweaks the payload so it no longer matches? With AI helping attackers analyze flaws and generate exploit variants in hours, that window keeps shrinking.
PHP2Shell makes this harder. Both CVEs come from memory management flaws in the PHP engine itself, not from a specific application’s logic. That means multiple exploitation paths with different request structures and triggering conditions. A signature that catches one variant doesn’t guarantee protection against the next.
What the attack looks like
One chain targeting CVE-2026-109618 includes a PHP_SESSION_UPLOAD_PROGRESS field in a multipart upload, even though the application endpoint never defines it. To a signature engine, the request can look like an ordinary upload. (The payload in this example is omitted.)
How Salt sees it
Salt doesn’t need to know the exploit. Salt learns the structure of your APIs, MCP calls, and application endpoints: which fields, parameters, and formats each endpoint expects. A request carrying a PHP_SESSION_UPLOAD_PROGRESS field to an endpoint that has never accepted one is an anomaly, and no signature is required to see it.
But spotting an anomaly is not enough. Plenty of unusual requests are harmless: a new client version, a misconfigured integration, a developer testing something. If every anomaly raises an alert, defenders drown in noise and real attacks get lost in it.
The missing piece is intent. Salt’s behavioral intent detection adds the context needed to tell whether an anomaly is tied to malicious activity. Salt looks at the manner in which the consumer made the requests, compares to how the application endpoint is normally used, and monitors and compares hundreds of other behavioral attributes. An odd field from a familiar client looks very different from the same field sent by a consumer that is probing endpoints, rotating through payload variations, and behaving nothing like a legitimate user.
Anomaly tells you something is different. Intent tells you whether it’s an attack.
We’ve seen this movie before
This isn’t a one-off. When Log4Shell hit, Salt detected exploitation attempts against customers before any signature had been released. The vulnerability was different, but the principle was the same: attacks on infrastructure-level flaws still have to arrive as requests, and the consumers sending them behave differently from the legitimate users of your APIs and application endpoints.
Behavioral detection holds up in exactly the situations where signatures can’t. When a flaw lives in the infrastructure rather than the application code, a single request can be enough to take over a legitimate system. Protection that starts after the signature is written starts too late.
The takeaway: zero-days are the warm-up
Zero-days will keep coming. What’s changing is the surface they land on.
As enterprises move through their AI transformations, machine-to-machine traffic is growing fast. APIs, MCP servers, and agents calling other agents and services are multiplying, and fewer and fewer of those calls have a human anywhere near them. That means more targets, more consumers, and more places for a single flaw to be exploited.
At the same time, threat actors and rogue agents are no longer just knocking at the edge. They’ve moved inside it. Once there, they look like any other workload making API calls, and the perimeter tools built to inspect traffic at the front door often never see them. In that environment, a signature has nothing to match and a structural anomaly alone isn’t enough, because almost everything inside looks like one machine talking to another.
This is why intent matters more than ever. The question is no longer only “does this request look unusual?” It’s “who is making it, how are they behaving, and what are they trying to do?” PHP2Shell is a clear example of the patch gap, but the bigger story is that the gap is now everywhere machines talk to machines.
Defenders need protection that understands their own APIs and the intent of whoever is calling them, so they can stop attacks on day zero, before the patch, before the signature, and before the variant nobody has documented yet.
That’s what Salt is built to do.