これは始まりなのか、終わりなのか？｜PHP2Shellと自律する知能の境界
Beginning or End? PHP2Shell and the Boundary of Autonomous Intelligence The PHP2Shell incident marks neither the birth of a machine will nor the end of human governa
Beginning or End? PHP2Shell and the Boundary of Autonomous Intelligence
The PHP2Shell incident marks neither the birth of a machine will nor the end of human governance. It may mark the erosion of a practical monopoly: complex software flaws no longer need to be discovered and made exploitable solely through prolonged human expert effort.
On 21 October 2026, PHP released patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2. CERT-EU urged immediate updates and isolation of exposed systems where patching was not possible. Wiz reported using Atlas, Gemini 4 Argon and GPT-5.6 Sol in the research. The coordinated disclosure and repairs involved human researchers, maintainers and many organizations. Preventive website shutdowns are not evidence that those websites were compromised.
This distinction matters to my central research subject: AI that acts without ongoing step-by-step human instruction. Such agents can plan, test, revise and use tools, but their operational autonomy does not show that they independently selected their ultimate goals or acquired moral authority.
Thomas Hobbes wrote Leviathan amid England's experience of civil war. Charles I was executed in 1649, and Charles II returned with the Restoration in 1660. Their era helps frame a modern question: who may suspend public services for collective security, on what evidence, and who must restore them? A technically justified shutdown can still impose costs on hospitals, schools and citizens. If autonomous AI recommends or implements such decisions, public accountability cannot be reduced to a performance score.
Spinoza's inquiry into causal explanation, set against the era of Louis XIV's concentrated royal power, raises a second question. Knowing how to act does not by itself establish a right to govern others. The ability to locate a security weakness does not authorize its exploitation.
Imagined dialogue—not historical quotation:
Hobbes: “A power established to protect people must still answer the question of whose power it is.”
Charles II: “Who is responsible for opening the gate after ordering it closed?”
Spinoza: “Explaining a mechanism does not settle the legitimacy of its use.”
Louis XIV: “Who constrains a capability greater than any one official?”
Author: “That is precisely what research into autonomy must investigate.”
My test remains empirical. Who assigned the objective? Which choices were delegated? Could humans stop the process? How were false findings counted? Who determined disclosure timing? Wiz's own account describes coordinated work, so claims that an independent AI decided everything would outrun the evidence.
My provisional answer: an old assumption about exclusively human technical expertise is weakening; a new governance challenge is beginning. Autonomous action is not yet independent will. The gap between capability and legitimate authority is the subject of this research.
Sources: Reuters (21 Oct 2026), CERT-EU Advisory 2026-018, PHP release announcements, Wiz PHP2Shell and Atlas research (links in Japanese source list).
