This past week, two critical flaws (CVSS 9.2) were patched in PHP, the language running 70% of the web. They'd been sitting in the code since 2012.
What found them? AI. Several research teams pointed frontier models at the source and surfaced in weeks what a decade of traditional threat hunting had missed.
That's the real news, and it should change how you think about risk: the timeline between "a vulnerability exists" and "here's a working exploit" is collapsing. AI was being used to write exploits for PHP2Shell before the patch even shipped.
Quarterly patching with an annual pentest isn't just thin anymore, it's officially obsolete. Continuous monitoring with AI augmentation is the new baseline.
What to do — today:
→ Patch any PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35+. There's no safe workaround; updating is the fix.
→ Find what you forgot if you run — WordPress, Drupal, legacy internal tools. You can't patch what you don't know exists.
→ Ask every vendor: "Are you patched for PHP2Shell?" Their answer tells you everything.
→ If you were unpatched and internet-facing, rotate your keys, passwords, and tokens. These flaws can leak credentials and API keys from memory.
Vulnerability management is now a continuous discipline, or it's a liability.
We patched Sanctum™ within hours and it helps our clients answer "are we exposed, and are our vendors?" across their entire estate in minutes, not days. If that's a question you'd rather not scramble on next time, let's talk. 📩
#CyberSecurity #VulnerabilityManagement #PHP #ThirdPartyRisk #AppSec