On Wednesday, a programming language that runs roughly seven in ten websites shipped an emergency patch for two bugs that had been hiding in it for fourteen years. They were found with AI. The details leaked a day early, and within 45 minutes Cloudflare was counting tens of thousands of exploit attempts; by evening, millions. Governments in France, Germany, the Netherlands and Finland switched their own websites off rather than wait. The bug is called php2shell, and if you spent Thursday asking your team "are we on PHP?", so did everyone else.
Here's the part that should sting: none of this was a surprise. On July 7, the European Central Bank wrote to the CEO of every bank it supervises and said, in plain language, that AI models were finding vulnerabilities and writing working exploits "at unprecedented speed," and that banks should plan for it. Their action plans are due next Saturday, October 31. So this issue is about what the warning actually asked for, and why the honest answer is identity: you can't patch faster than AI finds bugs, but you can decide what a compromised machine is allowed to log in to. We also cover Workday buying C1 (and who might be next), Gartner's new trend report on AI agent identity, and a vendor spotlight on Lumos, the independent IGA player we think is now in play. The Buzzword Index and Breach Ledger are refreshed, and both now have a soundtrack. Press play in the corner. Let's get into it.
two weeks, distilled — & why it lands on your desk
Two critical memory-handling bugs in PHP (CVE-2026-109618 and -109619, scored 9.2) were found by Calif using OpenAI's GPT-5.6 Sol during an OpenAI-funded audit, and independently by Wiz. The PHP Foundation patched on Oct 21 after details leaked. Palo Alto counted 22.6M potentially vulnerable instances; AWS reports broad in-the-wild exploitation, including attempts before disclosure. Wikimedia services, French prefecture sites, German federal sites and several Japanese banks and airlines went offline as a precaution.
The ECB's July 7 letter (SSM-2026-0301, signed by Supervisory Board chair Claudia Buch) told significant institutions to submit a plan to their Joint Supervisory Teams by Oct 31, 2026 covering patching at scale, monitoring, and third-party risk, with structural asks including least privilege, MFA, and zero-trust "continuous verification of users, devices, applications, APIs and service accounts." The ECB says it will compare all submitted plans and share the findings.
Announced Oct 13 at Workday Rising; price undisclosed, expected to close by Jan 31, 2027. The logic: every hire, transfer and exit is already a Workday event, so access should follow it — for agents as well as people. It follows ServiceNow's ~$1.2B Veza buy, Cyera's ~$1B Oasis deal (closed in September; Oasis is now "Cyera Identity") and Okta's ~$200M Permiso pickup.
In an Oct 16 report, Gartner predicts that by 2028, 25% of enterprise breaches will trace back to AI agent abuse, and tells CIOs to inventory every agent, stop agents from using human credentials, and "demand converged IAM platforms" rather than "fragmented, AI-only solutions." Sample vendors with early capabilities: Aembit, Cisco (Astrix), GitLab, Microsoft Entra, Oasis Security and SailPoint.
Attackers signed in to 160+ Microsoft 365 tenants as ConnectWise's Cloud Backup app, using its shared secret and the directory-write rights it already had; no user logged in, so MFA never applied. Days later, LiteLLM's release pipeline was hijacked with GitHub tokens taken from logs, including an org owner's, and a credential-stealing build sat on PyPI for about two hours.
Axios reported Oct 22 that major US banks are detecting unauthorized third-party AI agents in customer accounts, with JPMorgan, Bank of America and Citi restricting them. Citi told the FT it doesn't permit third-party agents to log in or transact; Bank of America's Brian Moynihan said a human should authorize money leaving an account.
php2shell, the ECB's warning, and why the answer runs through identity
php2shell was not a black swan. It was the first very large example of something regulators, national cyber agencies and the vulnerability data had all been describing since spring: AI is making bugs cheaper to find than they are to fix. The response that scales isn't faster patching alone. It's making sure that when a machine is compromised before you patch it, it can't log in to anything important.
The chart below is the context. Using Epoch AI data on vulnerabilities disclosed by 20 large vendors, a16z plotted monthly critical- and high-severity CVEs: flat-ish for four years, then near-vertical from spring 2026. High-severity disclosures went from a typical 200–500 a month to roughly 2,350 in August. php2shell arrived on top of that curve, not ahead of it.
Re-read the ECB letter with this week in mind and it reads like a forecast. AI models, it said, are "capable of identifying software vulnerabilities and generating functioning exploits at unprecedented speed, compressing the timeline between vulnerability discovery and exploitation," and this is "a long-term shift in the threat landscape rather than a temporary phenomenon." It asked banks to prepare for "more frequent and higher-volume patching," to prioritise internet-facing systems and open-source components, and to assume perimeter defenses "will be breached." The same day, the European Systemic Risk Board issued a warning on systemic cyber risk from frontier AI, and the UK's NCSC had already told organizations to prepare for a "vulnerability patch wave."
The identity asks are in the structural section, and they're specific: least-privilege access controls, multi-factor authentication, accurate asset inventories, and zero-trust "continuous verification of users, devices, applications, application programming interfaces (APIs) and service accounts." Service accounts are named explicitly. That's the line to underline.
Patching shrinks the window. Identity shrinks what fits through it. Every php2shell victim this month will lose whatever its PHP servers could reach: the database password in the config file, the cloud key in the environment, the API token for the payment provider. Those are non-human identities, and most organizations can't list them, can't say who owns them, and haven't rotated them in years. ConnectWise and LiteLLM, the same week, showed what attackers do once they have them.
For EU banks, nothing new has to be legislated. DORA is already in force, and the ECB letter says its requirements "remain highly relevant." What changes after Oct 31 is that supervisors will have every significant bank's plan side by side, and the ECB has said it will share the results. Machine-identity hygiene is about to become measurable across an industry. Outside banking, US agencies (CISA, the FBI and NSA) spent this week telling organizations to patch or go offline, and Gartner's own prediction is that by 2030, changing agents will break 75% of traditional compliance frameworks because companies can't prove what an agent did. The direction is clear even where the rule isn't yet: you will be asked to show every identity, human or machine, that can reach a critical system, who owns it, and when it was last reviewed.
If this week moved machine-identity governance up your list, three names come up most in our conversations with identity leaders: Oasis, Linx, and SailPoint's Agentic Fabric. They are not the same kind of product, and the right one depends on what your regulator or board will ask you to prove.
| Oasis (now Cyera Identity) | Linx Security | SailPoint Agentic Fabric | |
|---|---|---|---|
| What it is | NHI specialist: discovery, ownership, posture and lifecycle for machine identities and agents | AI-native IGA for humans, NHIs and agents, with an autonomous governance agent (Autopilot) | Governance for agents and NHIs built on the same identity graph SailPoint uses for workforce IGA |
| Human governance (reviews, SoD, joiner-mover-leaver) | Not its focus | Yes, modern IGA | Yes — the most mature in the market |
| Machine identity and secrets discovery | Deepest of the three | Yes | Yes (plus Human Fabric linking machine access back to a person) |
| Agent governance | Yes | Yes (Agentic Identity Governance) | Yes; runtime agents (Blue/Red/Green) are roadmap, GA 4Q FY27 |
| Ownership | Acquired by Cyera (~$1B, closed Sep 2026); runs as a unit of a data-security company | Independent; $50M Series B (Mar 2026, Insight Partners); ~$83–85M raised | Public company (NASDAQ: SAIL) |
| In Gartner's Oct 16 sample vendor list | Yes | No | Yes |
| Watch for | Integration into Cyera's roadmap; identity teams buying from a data-security vendor | Scale: younger product, smaller install base | Roadmap vs. shipping; historically heavier implementations |
Our read: if your gap is narrow — "we can't find our service accounts and secrets" — a specialist like Oasis gets you there fastest, though you're now buying from a data-security company's roadmap. If you're replacing legacy IGA and want something built for agents from day one, Linx (our Issue 10 spotlight) is worth a serious look. But the question regulators are moving toward is broader than either of those: every identity that can reach a critical system, human or machine, traced back to an accountable person, with evidence. That favors one control plane over two, which is also Gartner's advice. Today, the broadest single answer to that question comes from the vendor that already governs the people: SailPoint is the only one of the three that covers workforce governance, NHIs and agents on one graph, and the only one of the three that both Gartner's sample list and a public balance sheet put behind it. The honest caveats: some of the runtime pieces are still roadmap, and SailPoint's implementations have historically taken longer than the newer tools'.
Workday buys C1 — and the independent IGA field gets smaller
C1 — ConductorOne until its April rebrand, and our Issue 12 spotlight — is going to Workday. It's the latest in a run of modern identity-governance companies bought by platforms that aren't identity vendors. That pattern matters more than the price, which neither side has disclosed.
Joiner-mover-leaver is the oldest problem in identity governance, and the source of truth for it lives in HR. Workday's argument is that if every hire, job change and exit is already a Workday event, the HR system should drive access directly, and extend that same control to the AI agents Workday already registers in its "Agent System of Record." It's a coherent thesis. It's also the same move ServiceNow made with Veza (~$1.2B) from the IT-service side, and Cyera made with Oasis (~$1B) from the data side. Each acquirer owns a different system of record and wants governance attached to it.
Nothing changes until close, which gives you roughly three months of leverage. Use it: check your order form for renewal dates, price caps and change-of-control terms; ask for a written commitment that C1 stays available and supported as a standalone product for at least one renewal term; confirm support for your HR system if it isn't Workday (SAP SuccessFactors, Oracle HCM); and export your access-review history and audit evidence in a format you control. Watch two specific overlaps: Workday already has its own Agent Gateway and C1 has an identity-aware MCP gateway, and C1 sells on consumption while Workday sells suites. One of each probably doesn't survive.
The modern, cloud-native IGA tier that grew up between 2020 and 2024 is being absorbed. Veza, C1 and Oasis are gone. The independents left with real customer bases are a short list — Lumos, Linx, and a handful of others — and they now compete against both the incumbents (SailPoint, Saviynt, Okta, Microsoft) and the governance features their former peers bring into much larger platforms. For buyers, that means two things: the independent you pick today has a real chance of being owned by someone else at renewal, and "which platform will this live inside in two years?" is now a legitimate diligence question.
Our pick for the next independent IGA vendor to be acquired is Lumos. It has a recognizable mid-market customer list, strong reviews, a product pivot to agents that acquirers want, and — as far as public filings and press show — no new funding since its $35M Series B in May 2024. That's two and a half years, in a market where C1 raised and then sold. The most likely kind of buyer is the one this deal just showed us: a system-of-record platform (HR, IT service or device management) that doesn't yet own governance, or an identity platform that wants mid-market IGA share quickly.
This is opinion, not reporting. We have no knowledge of any sale process at Lumos or of any interested buyer, and nothing here suggests talks exist. Lumos may well raise again or stay independent. The point for buyers is the same either way — see the contract checklist in this issue's spotlight.
Gartner's Top Strategic Technology Trends for 2027: AI agent identity
Gartner put AI agent identity on its list of ten top strategic technology trends for 2027. Read alongside php2shell, the report makes one point clearly: the same AI that is finding bugs faster is also being deployed inside companies as agents, often with credentials no one is governing. Attackers and agents are both multiplying. Identity is how you keep either from reaching too much.
| By | Gartner predicts | Our read |
|---|---|---|
| 2027 | A "phantom agent crisis" forces an 80% rollback of autonomous AI deployments | Agents nobody inventoried get switched off wholesale. Discovery is the cheap insurance. |
| 2028 | 25% of enterprise breaches trace back to AI agent abuse | Our Breach Ledger has logged nine AI-involved entries since June. This may prove conservative. |
| 2028 | Most enterprises adopt "dynamic composite identities" for mission-critical agents | Useful idea, slippery wording. We run it through the language test on the Buzzword Index. |
| 2029 | Autonomous AI outpaces 90% of human-in-the-loop safeguards | Approval queues can't keep up. Pre-approved, narrow scopes have to do more of the work. |
| 2030 | Agent mutability breaks 75% of traditional compliance frameworks | The audit problem. If you can't say which version of an agent did something, you can't prove it was allowed to. |
Gartner's recommended actions are sensible and unglamorous: inventory every agent, sanctioned or not; stop agents from using human credentials; give them short-lived, scoped access; require human or "guardian agent" approval for high-risk operations; and buy converged platforms that govern human and machine actors from one control plane "rather than deploying fragmented, AI-only solutions." The third is the one php2shell makes urgent. A compromised web server and a misbehaving agent are the same problem from an identity point of view: a non-human actor holding credentials. If those credentials are short-lived and narrowly scoped, the damage is small. If they're standing secrets with broad rights — like ConnectWise's backup app — it isn't.
Gartner lists six "sample vendors with early AI agent identity capabilities." Sample lists are illustrative, not rankings, but they're where shortlists start:
| Vendor | What they bring to agent identity |
|---|---|
| Aembit | Workload identity and secretless, policy-based access between machines |
| Cisco (Astrix) | NHI discovery and security, listed under Cisco |
| GitLab | Identity for agents and pipelines inside the software supply chain |
| Microsoft Entra | Agent identities and Conditional Access in the Microsoft identity platform |
| Oasis Security | NHI discovery, ownership and lifecycle; now part of Cyera |
| SailPoint | Identity governance across humans, NHIs and agents on one identity graph |
Two things stand out. First, only two of the six — Microsoft and SailPoint — already run governance for human identities at enterprise scale, which is the "converged" model Gartner tells CIOs to demand. Second, the list is a snapshot: two of the names (Astrix and Oasis) have already been absorbed into larger companies, which is the consolidation the report itself predicts.
Lumos — customers love it, agents are the pivot, and it's probably in play
On G2, Lumos rates 4.7/5 across 69 reviews, with ease of setup 9.0, ease of use 9.3 and quality of support 9.7. For comparison on the same page, SailPoint rates 4.5 across roughly 200 reviews (setup 8.0, use 8.5, support 8.0). Reviewers praise the app store for access requests, automated offboarding and access reviews, SaaS license reclamation and a responsive success team. The AWS Marketplace listing prices the core platform at $27,000 for 12 months, plus $180 per additional user per year.
In June, Lumos launched six named AI agents for access reviews, access requests, role mining, entitlement analysis, finding owners for NHIs, and finding owners for AI agents. In September it added MCP Governance, which checks an agent's permissions at the moment it calls a tool and blocks what policy doesn't allow, starting with Claude Code and Codex. Lumos says it measured over 450,000 agent actions in one week inside its own company of under 200 people.
The most common complaints on G2 are integration issues (7 mentions) and limited integrations (6); one reviewer notes missing native AWS, GCP and Azure integrations. MCP Governance supports two agent clients so far. We found no independent technical evaluation of its NHI or agent capabilities, and public docs don't establish secrets management, OAuth app governance or workload identity. Separation-of-duties modelling and complex on-premises estates are not where Lumos is strongest.
Lumos's last announced round was the $35M Series B in May 2024; announced rounds total over $65M (the company says $85M+). It reports roughly 160 employees and says revenue grew 9x since its previous raise (vendor-reported). On Glassdoor, the profile we believe is Lumos (26 reviews; we couldn't confirm the match) shows 4.7/5 and 95% CEO approval, but recent reviews cite "high turnover recently," "operational inefficiencies" and a "lack of promotion path for GTM."
Lumos is the best-liked tool in a segment that is consolidating fast. Its reviews are as good as anyone's in IGA, its product moved to agents quickly and sensibly, and its price point makes governance reachable for companies that would never sit through a two-year IGA program. On implementation ease it ties the highest score we've given any vendor — 8.5, the same as C1 in Issue 12.
The scores below eight are about scope and runway, not quality. Product scores 6.5 because the agent and NHI capabilities are new and unproven at enterprise scale, and integration breadth is the recurring complaint. Stability scores 5.5 because two and a half years without a disclosed raise, in a market where comparable companies have sold, leaves an open question about what comes next. Independence Outlook scores 3.5 because, after Veza, C1 and Oasis, Lumos looks like one of the most natural remaining targets in the category.
That doesn't make it a bad buy. An acquisition can be good for customers if the buyer invests. It just means you should buy Lumos the way C1's customers now wish they had bought C1: with change-of-control protection in the contract from day one.
three things to do this fortnight
Patching a PHP host that was exposed before Oct 21 isn't the end. Assume its config was read. Rotate database passwords, cloud keys and API tokens stored in its environment and config files, revoke and reissue session secrets, and check cloud logs for those keys being used from new places. Then shorten their lifetimes so the next wave finds less.
In Microsoft Entra, list the service principals with application permissions like Directory.ReadWrite.All, RoleManagement.ReadWrite.Directory or full mail access. For each one, name an owner, ask whether it needs that scope, and set an alert for any service principal that grants itself a role. Most organizations find vendor apps nobody remembers approving.
Your IGA vendor may not be independent at renewal. Standard asks: termination rights on change of control, a standalone-support commitment, a renewal price cap, and guaranteed export of audit evidence. Cheap to get when you're signing. Expensive to get once a deal is announced.
one line to sound three moves ahead in your next exec meeting
php2shell went from leak to millions of exploit attempts in under a day, and the ECB warned banks in July that this was coming. Patching speed still matters, but it has a ceiling. The control that scales is making sure every machine and agent holds only the access it needs, for only as long as it needs it, with a named owner. That's an identity-governance program, and regulators are about to start comparing them.
what identity leaders were saying this fortnight