Vulnerabilities are on the rise. What about you ?

PHP2Shell, Node2Shell… The events of the past few days serve as a reminder of one reality: the pace of cybersecurity is accelerating. And artificial intelligence is playing a significant role in this.

AI is gradually transforming the way vulnerabilities are identified and analyzed. PHP2Shell is a recent example: the two critical vulnerabilities hidden behind this name were discovered as part of research involving Wiz, Calif, and OpenAI, among others, with AI playing a significant role in identifying the vulnerabilities and developing exploits.

For businesses, the key takeaway is therefore no longer simply that a new critical vulnerability has been discovered, but that the time available to respond to it is becoming a major challenge.

AI Is Changing the pace of Cybersecurity

For a long time, identifying a complex vulnerability could take weeks or months of human analysis.

AI capabilities now help researchers analyze large amounts of code and identify behaviors that could lead to a vulnerability.

PHP2Shell is particularly telling. The vulnerabilities CVE-2026-109618 and CVE-2026-109619 allow for remote code execution and have been rated 9.2/10 according to CVSS v4.0.

But this acceleration potentially benefits both sides.

Security researchers can identify a vulnerability more quickly, while the analysis required to understand or exploit a flaw can also be completed faster.

The time between the discovery of a vulnerability, the release of a patch, and its potential exploitation is thus under pressure.

And for businesses, every hour can count.

Patching is no longer just a routine maintenance task

When a critical vulnerability is disclosed, a company must be able to quickly answer several questions:

• Are we affected?
• Which devices, servers, or applications use the vulnerable technology?
• Which versions are currently deployed?
• Is there a patch available?
• Which systems should be addressed first?
• Have we detected any suspicious activity?

Without an accurate inventory and a predefined process, answering these questions can already take up valuable time.

That is why a structured patch management procedure is an essential part of any cybersecurity strategy.

In the case of PHP2Shell, patched versions of PHP were quickly released, with a clear priority: securing services exposed to the Internet.

1. Understanding Your Fleet Through Asset Management

You can’t effectively protect what you don’t know exists.

Asset management provides an overview of the hardware, systems, software, and versions present in the information system.

When a new vulnerability is discovered, this knowledge makes it possible to determine more quickly which assets are affected and to set priorities.

The issue of software versions is particularly important: regarding PHP2Shell, the actively maintained versions 8.2 through 8.5 have received new, patched versions, whereas certain older, end-of-life branches have not received new official binaries.

Maintaining obsolete technologies is therefore not just a technical debt. It can become a security debt.

2. Standardize patch management

Identifying the vulnerability is only the first step.

Next, you must be able to determine where the patch should be applied, prioritize the most exposed assets, and deploy the appropriate updates.

When no patch is yet available, temporary measures must be put in place to reduce risk exposure, such as isolating the affected system, strengthening controls, or implementing workarounds, while waiting for the patch.

A clear procedure and a patch management tool can then prevent every critical vulnerability from turning into an improvised crisis management situation.

3. Keep an eye on what’s happening through monitoring and the SOC

Even with an effective patching policy, monitoring remains essential.

A vulnerability may have been exploited before the organization has been able to complete its patching process.

This is where monitoring tools and the oversight provided by a SOC (Security Operations Center) come into their own: they complement the preventive approach of patch management with a detection-based approach.

This complementary approach becomes all the more important as the cycles of vulnerability discovery and exploitation accelerate.

Don’t wait for the next critical vulnerability

PHP2Shell will obviously not be the last critical vulnerability to make headlines.

And that, ultimately, is the main lesson to take away.

The question is no longer just: “Have we installed the latest patch?”

It has become:

“Are we able to quickly identify our exposure, patch our systems, and detect a potential compromise when a new vulnerability emerges?”

In an environment where AI is accelerating cybersecurity research, organizations must also become faster.

Asset management, system maintenance, patch management, monitoring, and SOC oversight: the ability to respond cannot be improvised the day a critical vulnerability is disclosed. It must be prepared in advance.