Analyst note. This research note analyzes public-record sources on payment-system security and market structure. It is not investment advice, not an endorsement of any issuer, protocol or asset, and not a solicitation. Factual statements are cited to first-party or official sources; interpretation is marked Analysis.

The week the password failed

Between October 13 and October 21, 2026, two stories that looked unrelated entered the public record.

The first came from bank earnings calls. Two of the largest U.S. banks told analysts they will not let just any outside AI agent operate inside customer accounts on borrowed logins [6] [7]. The second came from the software beneath the web. On October 21 the PHP project shipped emergency fixes for two critical flaws in the language behind most websites, flaws found with the help of frontier AI models [1] [2]. The same day, the Office of the Comptroller of the Currency finalized its rule implementing the GENIUS Act for payment stablecoin issuers [12].

Read together, the record describes one problem and points toward one fix. The problem is authority bound to a secret: a password, a session token or an API key, honored in full by whoever holds it. The fix, already under construction across banks, card networks, technology firms and regulators, is authority that is signed, scoped and checked by the payment rail itself.

I. The runtime layer: PHP2Shell

The two flaws, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated remote code execution on servers that use PHP to answer web requests. The project’s own release notes left no room for workarounds: there are no complete mitigations, and “updating is the only safe choice” [1].

Two features set this disclosure apart. The first is where the flaws live. They sit in PHP’s engine, below any application built on it. CrowdStrike confirmed end to end that one unauthenticated request was enough to make an Apache worker open a shell and execute commands of the attacker’s choosing; no session was needed, and the application’s own code played no part [3]. Careful application maintenance offered no protection. Wiz Research demonstrated a second path that bears directly on payments: an attacker could remotely read worker memory, where credentials from other requests can sit, including passwords, authentication tokens, API keys and certificates [2].

The second feature is how the flaws were found. According to Wiz, the vulnerable code had shipped for more than a decade, and showing that it could be exploited had been close to the limit of practical human effort. Wiz worked with frontier models including Gemini 4 Argon and GPT-5.6 Sol, coordinated disclosure with the PHP team, Calif and OpenAI, and credits the models with compressing months of elite-team effort into roughly a week for a single researcher. Placing the episode alongside Heartbleed and Log4Shell, Wiz wrote that PHP2Shell could mark “a similar turning point for the AI era” [2].

Governments treated it as an infrastructure event. The UK’s National Cyber Security Centre advised organizations that could not apply mitigations quickly to consider taking affected systems offline until they were fixed [5].

Precision matters here. As of October 23, CrowdStrike had seen testing, probing and unsuccessful attempts, but no successful exploitation in the wild or in its honeypots, and noted that working exploits must be adapted to the specific PHP version and application in use [4]. That tailoring cost is the barrier between disclosure and mass exploitation, and it is the cost capable models are lowering. Wiz describes language models adapting exploits across PHP versions, configurations and memory layouts [2].

Analysis. PHP runs roughly seven in ten websites [4]. A runtime flaw that can expose API keys and session tokens from server memory is therefore a payments problem as much as a web problem.

II. The account layer: agents on borrowed logins

The bank side of the story is narrower than the headlines, and more instructive.

On JPMorgan Chase’s October 13 earnings call, chief financial officer Jeremy Barnum said the services now offering agent-driven money movement typically rely on credential sharing, a practice the bank has long opposed as insecure. Where JPMorgan can block such services, he said, it does, and customers who hand an agent their credentials own the consequences if it does something they did not want [6]. Chairman and chief executive Jamie Dimon framed the defensive concern in a single line: “you don’t want rogue agents, and there could be thousands of them” [6]. He was not arguing against agents. JPMorgan uses them internally and is piloting its own cash-management agent, and Dimon added that regulators should be preparing for a world full of bots [6].

Two days later, on PNC’s call, chairman and chief executive William Demchak called current attempts by third-party agents to transact inside customer accounts dangerous. Before such transactions could happen, he said, laws would have to shift liability, and access would have to run “through secure connections and authentication and human in the loop” [7].

Analysis. In both cases the objection is to an authority model, not to automation. An agent holding a customer’s password is indistinguishable from the customer. The bank sees a login rather than an actor, and cannot tell intended instructions from drift or compromise. Faced with that ambiguity, the only safe responses are to block access or to restrict it.

The same tooling is already on offense. On October 7, CrowdStrike reported that from late September into early October an unnamed actor, assessed with moderate confidence as Chinese-speaking and financially motivated, ran a campaign against South Korean financial organizations that ended in exfiltrated data. The actor used ARTEX, a recently released open-source agentic penetration-testing tool developed in China, together with large language models. Industry reports cited by CrowdStrike describe side doors rather than front doors: a loan-status service used by brokers at one bank, and an employee mobile work system at another. CrowdStrike’s assessment was that AI tooling let a single financially motivated actor conduct multiple intrusions in a short span [8].

III. One root cause

Analysis. Strip away the specifics and both stories describe the same design. Authority lives in a secret, and the system honors the secret rather than the intent behind it. PHP2Shell showed how such secrets leak from the infrastructure underneath. The bank calls showed what happens when customers hand them out deliberately. ARTEX showed how cheaply they can now be hunted.

Patching closes a specific hole; it does not change the model. The durable fix is to stop treating possession of a secret as proof of authority, and the bank executives sketched the replacement themselves: secure connections in place of shared passwords, authentication of whoever is acting, a human in the loop, and liability that follows the authority [6] [7].

IV. The architecture already arriving

The components of that replacement are no longer hypothetical, and each answers a specific failure in the record above.

An identity of the agent’s own. Visa’s Trusted Agent Protocol, released in October 2025 and developed with Cloudflare, uses “agent-specific cryptographic signatures” so that merchants can recognize approved agents and separate them from malicious automation. Visa is aligning the protocol with the IETF, the OpenID Foundation and EMVCo, and with Coinbase’s x402 for interoperability. Citing Adobe data, Visa reported that AI-driven traffic to U.S. retail sites rose more than 4,700% in a year [9]. Mastercard’s Agent Pay is designed to require agents to be registered and verified before they can pay, issues Agentic Tokens built on the network’s existing tokenization, and adds merchant interfaces to “distinguish trusted agents from bad actors” [10].

A signed scope for every permission. Google’s Agent Payments Protocol, AP2, announced in September 2025 with more than 60 organizations, replaces implied authority with mandates: signed digital records, which cannot be altered after the fact, of what a user authorized, from the initial intent through the exact items and price. The result is an audit trail built for accountability. AP2 is payment-agnostic, spanning cards, real-time bank transfers and stablecoins [11]. Mastercard’s program is likewise designed to give consumers control over what an agent is allowed to buy [10].

Money that carries rules, under supervision. The OCC’s final rule sets out the requirements for payment stablecoin issuers under its jurisdiction, along with certain custody activities, and takes effect with the GENIUS Act on January 18, 2027 [12]. Comptroller Jonathan V. Gould described “strong standards for reserve backing, redemption, and risk management,” and Treasury Secretary Scott Bessent likened the act to the National Currency Act of 1863 [13]. Banks are building the deposit-based version. In November 2025, Kinexys by J.P. Morgan made JPM Coin (JPMD), a USD deposit token, available to institutional clients on Base, a public blockchain, for near-instant settlement around the clock, and designed for integration with smart contracts [14].

Settlement anchored in central bank money. The Bank for International Settlements has published the most complete public-sector blueprint. Tokenised central bank reserves, commercial bank money and government bonds would share a unified, programmable ledger, on which payment instructions, compliance pre-screening and settlement execute together as one atomic transaction. The BIS describes the compliance dimension as “integrity by design” [15].

Analysis. Taken together, these pieces invert the model that failed in October. Authority stops being a secret that can be copied and becomes a credential that can be verified, limited and revoked. The rail checks the mandate before value moves, instead of reconciling the damage afterward.

V. What this thesis must concede

An argument for programmable rails that ignored the record of digital assets would not be credible.

  • The new rails have been robbed at scale. The FBI attributed the theft of approximately $1.5 billion from the exchange Bybit in February 2025 to North Korea [16]. Complaints involving cryptocurrency accounted for $11.37 billion of the $20.88 billion in losses reported to the FBI’s Internet Crime Complaint Center in 2025 [17]. Much of that is fraud, which turns on persuasion rather than code, and theft of keys, which is the same credential problem in a different venue.
  • Finality cuts both ways. In 2025 the IC3 Recovery Asset Team froze $679 million of $1.16 billion in attempted theft, a 58% success rate achieved by freezing and recalling bank transfers [17]. Final settlement removes that backstop unless checkpoints are designed in deliberately.
  • Endpoints still fail. Analysis. A runtime flaw like PHP2Shell can compromise an exchange’s web front end as easily as a bank’s. Ledgers do not secure the servers in front of them; the argument here concerns the authority model, not any particular ledger.
  • Quantum risk applies to every rail. Banks and public blockchains both depend on public-key cryptography. The G7 Cyber Expert Group’s non-binding roadmap points to 2035 as a sector-wide migration target, suggests addressing the most critical systems around 2030 to 2032, and warns that data captured today could be decrypted later [18].
  • Stablecoins are not the whole answer. The BIS judges stablecoins weak on the tests of singleness, elasticity and integrity, suited at best to a subsidiary role, with central bank money at the core of the next system [15]. The architecture described here is consistent with that view: regulated stablecoins and deposit tokens operating above settlement in central bank money.
  • The law lags the code. Demchak tied agent transactions to new liability laws [7]. Until those rules exist, the banks’ stated default is to block [6].

VI. The forward view

Analysis and outlook. The vision that follows from this record is not a token. It is a new grammar for authority.

In the system now being assembled, an agent arrives with an identity of its own instead of a borrowed password. It carries a mandate that a person signed, scoped to an amount, a counterparty and a deadline. The rail verifies that mandate before value moves, routes exceptions to a human, and settles with finality in money anchored to the central bank. Every action leaves an audit trail tied to an accountable principal, and compliance moves out of after-the-fact reconciliation and into the transaction itself.

No single institution has to win for that system to work. Card networks are supplying agent identity. Technology firms are supplying the mandate layer. Banks are tokenizing deposits, regulated issuers are entering a federal framework, and central banks are designing the settlement core. Public ledgers can serve as neutral movement layers between them.

Agentic finance is arriving either way. Visa’s figures show the traffic, and two of the largest U.S. banks are building agents of their own [9] [6] [7]. The open question for 2027 is whether it arrives on borrowed passwords and emergency patches, or on rails built to know who is acting, on whose authority, and within what limits. October 2026 made the choice visible. The institutions that act on it will set the terms of trust for the next decade of payments.

Stellae Liquiditas LLC · Research Note · 25 October 2026. Analysis of public-record sources; not investment advice. Figures are as reported by the cited sources on the dates shown.

Sources

  1. PHP Group, PHP 8.5.12 release notes, 21 October 2026.
  2. Wiz Research, PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet, 21 October 2026.
  3. CrowdStrike, CrowdStrike Protects Customers from Threats Delivered via PHP2Shell, 21 October 2026.
  4. CrowdStrike Counter Adversary Operations, Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation, 23 October 2026.
  5. UK National Cyber Security Centre, Critical security issue affecting PHP, 21 October 2026.
  6. JPMorgan Chase & Co., Third-quarter 2026 earnings call, 13 October 2026.
  7. The PNC Financial Services Group, Third-quarter 2026 earnings call, 15 October 2026.
  8. CrowdStrike Counter Adversary Operations, Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance, 7 October 2026.
  9. Visa Inc., Visa Introduces Trusted Agent Protocol, 14 October 2025.
  10. Mastercard, Mastercard unveils Agent Pay, 29 April 2025.
  11. Google Cloud, Powering AI commerce with the new Agent Payments Protocol (AP2), 16 September 2025.
  12. Office of the Comptroller of the Currency, Bulletin 2026-50: GENIUS Act Regulations, Final Rule, 21 October 2026.
  13. Office of the Comptroller of the Currency, News Release 2026-92, 21 October 2026.
  14. J.P. Morgan (Kinexys), First bank issues USD deposit token on a public blockchain, 12 November 2025.
  15. Bank for International Settlements, The next-generation monetary and financial system, Annual Economic Report 2025, 29 June 2025.
  16. Federal Bureau of Investigation, North Korea Responsible for $1.5 Billion Bybit Hack, PSA I-022625-PSA, 26 February 2025.
  17. FBI Internet Crime Complaint Center, 2025 IC3 Annual Report, April 2026.
  18. G7 Cyber Expert Group, Statement on Advancing a Coordinated Roadmap for the Transition to Post-Quantum Cryptography in the Financial Sector, January 2026.

Tier 2 (finding aids only, not cited in the body):

  • Benzinga transcript of the JPMorgan Chase Q3 2026 earnings call (via Webull), used to verify the wording of remarks cited to [6]. Not cited; statements attributed to the first-party call.
  • TradingKey transcript of the PNC Q3 2026 earnings call, used to verify the wording of remarks cited to [7]. Not cited; statements attributed to the first-party call.
  • Press reporting on third-party AI agents in U.S. bank accounts (Axios, CBS News, PYMNTS), used to locate the earnings-call remarks. Not cited; the article relies only on the banks’ own on-record statements.
  • Korea Herald and Reuters reporting on South Korean bank breaches, used to locate the CrowdStrike report. Not cited; per-institution breach counts omitted because no first-party source was located.