The next major cyberattack may not begin with a secret exploit developed by an elite hacking group. It may begin with a patch that defenders have not installed yet, because increasingly powerful AI systems can turn fixes into attack instructions while organizations struggle to keep pace.
That gap came into view last month when the SANS Internet Storm Center raised its threat level for the first time since December 2021. By its own records, SANS had taken that step only 10 times since 2010, making the warning a rare signal that a software vulnerability had moved from technical concern to active emergency.
PHP2Shell Put Millions of Servers in the Crosshairs
The immediate cause was PHP2Shell, a pair of vulnerabilities in PHP, the programming language behind about 70% of websites whose language is known. The flaws had lurked in PHP since at least 2012, until a researcher working with an OpenAI model found them. They allowed an attacker to take over a web server, turning a hidden weakness into a direct path through internet-facing systems.
PHP’s maintainers released a patch on Oct. 21, but attacks were already under way. Finland took government websites offline, the Dutch parliament’s site went dark, and the National Security Agency and Britain’s National Cyber Security Centre urged organizations to take offline any system they could not fix at once.
That sequence exposes the hard limit of every software patch: it protects only the servers on which someone installs it. Qualys counted 167 million PHP installations on its customers’ systems, yet 12 hours after disclosure, about one in a thousand had been updated. The gap can last weeks, giving attackers a wide field of unpatched targets.
AI is changing the speed of that race. A model can now derive from a patch which vulnerability it fixes and how to exploit it, converting work that once required intelligence services or elite hacking groups into a task AI can perform. Defenders have not kept up.
A survey of 300 U.S. security leaders shows why. Sixty-nine percent said attackers could build a working exploit within three days, while 44% said their organizations need four days or longer to patch a critical vulnerability across production. Eighty-five percent reported an incident, suspected incident, or near miss attributable to slow patching.
- Twenty-two percent said their patching window falls below 24 hours.
- Fifty-six percent said they can deploy a critical patch across production within three days.
- Thirteen percent can do so in under 24 hours, while 43% need one to three days.
- Thirty-two percent need four to six days, and 12% need more time.
- Fifty-nine percent acknowledged greater exposure from AI-powered attack tools without changing their security posture.
The same research found that 58% of surveyed organizations need four to six days or a week or longer to patch, while 33% reported one to three days and 9% reported less than 24 hours. No respondent said testing was skipped.
Linux and Equifax Show the Cost of Waiting
PHP2Shell is not an isolated warning. On Oct. 27, Anthropic said its Claude model had written an exploit that seizes control of some Linux servers through a vulnerability in how they handle network connections. Linux’s developers fixed that flaw on Oct. 5, yet as of Nov. 2, Ubuntu, one of the most widely used versions of Linux for servers, still had not shipped the fix.
The pattern has a long and costly history. In March 2017, the Apache Software Foundation patched a vulnerability in Struts, software that companies use to build websites. Two months later, attackers used it to break into Equifax, which had not installed the patch. The breach involved stealing personal data on 147 million Americans.
Equifax had two months to install its patch. PHP2Shell’s targets were under attack before their patch existed. That shrinking window is the central challenge for security teams: the time between discovery, exploitation, and public harm can now fall below the time required to test and deploy a fix.
The Azul 2026 AI Vulnerability Gap Report, commissioned by Azul and conducted by Censuswide, also examines the demands of software maintenance. It tracks full OpenJDK quarterly releases across 26 updates over more than six years, with six identified as causing a serious regression, alongside a 23% figure in the report’s findings.
Cyber Warnings Need the Reach of Weather Alerts
The public often hears about a breach after the damage is done, but it rarely hears about the vulnerability that made the breach possible. Using Media Cloud, an open archive of online news, the author measured coverage of 25 major cyber events. In the eight days after each became public, not one national outlet tracked published a story about the patch.
The Equifax breach drew a median of 16 of every 1,000 stories each outlet published. By contrast, in the eight days after PHP2Shell became public on Oct. 20, CNN, Fox News, NPR, and USA Today published 5,610 stories. Only nine mentioned PHP2Shell or the week’s other major vulnerabilities, and two put them in a headline.
A record 5,461 stories were published in the week of Oct. 12 alone, more than 15 times the weekly average in 2020. The Storm Center flagged 10 such events from 2010 through 2021, yet for six of them, the median national outlet ran no story.
The answer proposed here is simple: the public needs the equivalent of a hurricane watch. The National Weather Service issues watches and warnings in plain language, and CISA, the federal Cybersecurity and Infrastructure Security Agency, should do the same. A public watch should begin when a critical vulnerability appears in widely used software; a warning should follow when attacks begin.
Newsrooms already cover car and food recalls. They should cover these warnings, too, because people cannot weigh risks they have not heard about.
Even AI companies are sounding the alarm. Jason Clinton, Anthropic’s deputy chief information security officer, wrote last month that things “are going to get a lot worse before they get better,” and urged security leaders to “go to your boards and ask for help right now.”
The Congress that takes office in January will decide how to pace the AI frontier, how much to spend on the agencies that warn us, and who pays when a company’s unpatched server exposes its customers. AI is reshaping the threat by the week, but deciding how to respond still falls to lawmakers, corporate boards, and the public they answer to.
The goal is not to wait for the storm surge to announce that a hurricane is coming. It is to warn people while there is still time to act—and before the next breach tells the public what happened.
Based on
