An AI Turned Drupal's Patch Into a Working Exploit in Under an Hour for Under $10

Drupal did everything a careful vendor is supposed to do. On May 20, 2026 it shipped a patch for CVE-2026-9082, an Entity Query SQL injection flaw in the core of a platform behind public sites for large companies, public bodies and universities ^[1][4]. It pre-announced the fix more than 48 hours ahead and asked operators to reserve time in the Wednesday release window so they could apply it the moment it landed ^[3]. The security firm Miggo treated that same pre-announcement as a schedule for an attack.

Miggo pointed Claude Code at the supported Drupal branches, went to dinner, and came back to find the model had detected the patch, isolated the critical commit, stood up a vulnerable Drupal instance in a Docker container, and built a working SQL-injection oracle against it ^[6]. The patch was detected at 5:12 UTC; Miggo had a functional exploit to full SQL injection and remote code execution at 6:03 ^[8]. That is 51 minutes ^[33]. The first public proof-of-concept did not appear on GitHub until 05:25 the next morning, with a second a few hours later ^[9], roughly 23 hours behind the private one ^[34].

The speed was not fully autonomous, and Miggo says so. A human researcher had to nudge the model past a syntactic obstacle in the injection path: five failed payloads, a manual step reading the leaked SQL out of a 500 error body, and two refinements ^[7]. The information the defender published collapsed the timeline. A security patch is a diff, and a diff shows precisely which lines changed. Drupal's pre-announcement narrowed the window to watch, and by Miggo's account the commit inside it accounted for half the analysis ^[3][6].

The flaw itself was a throwback. SQL injection was the canonical web vulnerability of the early 2000s, and mature platforms have steadily engineered it out with ORMs, parameterized queries, and static analysis ^[5]. Its reappearance in a modern CMS core is unusual.

The economics are what make this a planning problem. Miggo's run cost under $10 in model tokens ^[2]. Other reporting points the same way. Chainalysis says blockchain dead drops, a method for hiding malware instructions on public chains, "have surged 440% since the launch of Chinese high-capacity open-source AI models that place no restrictions on generating malicious code" ^[12]. The team behind The Hacker News's weekly threat roundup put the shift plainly: "Faster tools are changing the pace, but basic mistakes are still doing plenty of the work" ^[13].

Criminal operations are already there. When Spanish police arrested a 16-year-old they suspect of running the KillSec ransomware group, Hamburg investigators said the group had used AI to build and operate its infrastructure and to identify victims, though they did not elaborate ^[15]. KillSec's way in was ordinary: exploiting software vulnerabilities and poorly secured access points, especially cloud storage, according to Hamburg police ^[14].

What a closed patch ticket proves

"The patch path is structurally slower than the attack path," Miggo wrote, pointing to the vetting, staging, and rollback planning that stand between a published fix and a deployed one ^[10]. Set against the 51-minute exploit, that asymmetry reframes the maintenance window ^[33]. The hours an operator spends qualifying a patch are hours an attacker can spend turning the same patch against everyone who has not finished ^[10].

A guide to board reporting for CISOs argues that security teams have long reported counts, vulnerabilities found, patches applied, alerts closed, phishing simulations passed, and that "These numbers measure effort. They don't measure risk" ^[28]. Boards, it says, want to see exposure, trends over time, and financial impact, and have less use for activity tallies, snapshots, and CVE counts ^[29]. A closed patch ticket is an activity metric. It records that a fix was applied; it does not tell you whether you were reachable in the window before you applied it.

When the patch is not the remedy

Patching also assumes a patch exists, and several of this period's critical advisories break that assumption in different ways.

When CISA added the FortiMail flaw CVE-2026-104286 to its Known Exploited Vulnerabilities catalog, rated 9.8, the fix was not ready ^[16]. Fortinet acknowledged the bug was already being exploited to let unauthenticated attackers write arbitrary files, and told customers to disable the IBE feature or wall off the management interface until fixed versions ship ^[16][17]. CISA still set federal civilian agencies an October 4, 2026 deadline to patch or mitigate ^[18]. For the days in between, the only control was a workaround.

Dell's set of CSM storage flaws, two scored a maximum 10.0, can be closed only by updating: Dell said there are "no workarounds or mitigations other than updating to the latest version," 1.18.0 ^[19][20]. FortiMail customers could buy time with a workaround. Dell's exposure runs until the update is finished. GitLab's AI Gateway flaw, CVE-2026-90970, rated 9.9 and disclosed on October 2, shows a different problem ^[21]. CISA's assessment on the record listed exploitation as "none" the day it was added ^[22]. The flaw is the second gateway bug of the same template-engine class, CWE-1336, that GitLab has fixed in 2026; the first, also a 9.9, was patched in February ^[23]. And GitLab's advisory does not include a way to check whether a gateway was attacked before it was updated ^[24].

Cleanup, the other kind of remediation, can also leave an infection in place. Sucuri described a WordPress backdoor it calls SC as a "self-healing mesh" whose payload lives in at least eight places at once, across files, the database, and shared memory, each able to rebuild the others ^[25]. "The result is a circular system with no single point you can remove to stop it," researcher Gabriel Barbosa said ^[26]. Sucuri's own summary applies beyond WordPress: "SC is a reminder that a modern WordPress infection can be a system rather than a file" ^[27].

Where the budget is drifting

The vendors selling into this moment are repositioning around exposure. Their language shows where the money is expected to go. Automox CEO Justin Talerico frames the endpoint job as "Patch what's patchable, mitigate what isn't, and govern the endpoint continuously" ^[31]; in that framing, patching is one of three continuous tasks. Surf AI's Yair Grindlinger is blunter about where the hard work now sits: "Discovery is commoditized. The middle is hard" ^[32].

None of this makes patching optional; a 10.0 that only an update can close still has to be closed ^[20]. But the interval between a published fix and a working exploit has shrunk to under an hour, and the run cost under $10 ^[2][33]. The board's question, are we exposed and by how much, is no longer answered by the count of tickets the team closed ^[28][29]. In the CISO guide's worked example, four tools each rate a finding low to medium, and together they form a critical path from a phishable contractor account to sensitive customer data that no single dashboard shows ^[30].

Miggo read Drupal's pre-announcement as the vendor conceding the same thing: any meaningful patch lag, "even waiting for the next maintenance window, is now too much exposure to accept" ^[11].