Suppose I told you, before the crash, exactly how the market would fall and exactly how bad it would get. Then Black Monday arrived and it went the way I said. If you'd taken my advice, how would you feel? If you'd ignored it, how dumb would you feel?
Now ask the only question that matters. Which of those do you want to be?
That's where every organization sits this week, whether it knows it or not.
The check engine light was on for years
Two critical flaws in PHP, nicknamed PHP2Shell, were disclosed and patched on October 21. They let an attacker take over a web server without credentials, and they affect every version back to PHP 5.4. PHP sits behind roughly 70 percent of the sites whose server-side language is known. Wikipedia runs on it. So do WordPress blogs and a long tail of shopping sites.
The weakness behind them was first spotted in 2020 and flagged again in 2024. It went unfixed because nobody had demonstrated an exploit. That's the check engine light logic. The light has been on for years, the engine hasn't died yet, so the light must not mean anything. The failure it warned about hadn't triggered. That's different from the light being wrong.
Now the exploits exist. Amazon's honeypots logged a first attempt on October 17, four days before the patch. CISA added both flaws to its Known Exploited Vulnerabilities catalog on October 26. A security firm holds a working exploit for one of them. Sensors at TU Delft have recorded more than 72,000 exploitation requests from 659 addresses since disclosure. Censys counted 32.5 million internet-facing PHP services on potentially vulnerable versions as of October 27, plus more than 60 million that don't report a version.
You can argue about how many of those attempts have succeeded against real systems. Some vendors walked back early compromise claims, and the public evidence of mass damage is thin. Don't hide in that argument. Waiting for confirmed damage before acting is the exact behavior this whole situation is warning against. It's the market-crash story again, and the advice is the same.
What I'd ask you in 15 minutes
I don't care whether you patched every PHP instance by Friday. Patching everything on a deadline creates chaos, and chaos is its own outage.
I care whether you can answer four questions, roughly, in 15 minutes.
- Where is PHP running in your company?
- How likely is it that those systems get compromised?
- What path would an attacker take to reach them?
- If one of those boxes is taken, what can the attacker reach from there?
Not perfectly. To a reasonable degree. Very few organizations can do this, and I'd guess the number is close to none.
If you can answer those four, you could defend ignoring this flaw for years. The attack path is known, the exposure is understood, and you accepted the risk on purpose. That's a decision. If you can't answer them, it's something else.
You're thinking like a horse. Spend thousands of dollars building shade for a horse, then walk him out into 100 degree heat (40C). There he stands, in the open field, with one piece of shade from a single pole, right over his eyes. Why? Because to a horse, if he can't see the sun, the sun can't see him. To a horse, that logic is flawless.
Why does the same logic seem to hold for so many executive teams and boards?
The clock is moving faster than your patch cycle
The numbers on remediation were bad before AI joined the conversation. Verizon's 2026 breach report puts the median time to fix a known exploited vulnerability at 43 days. Qualys reports that 63 percent of critical vulnerabilities are still open after a week. Both figures come from a vendor-sponsored article, so treat them as a rough guide. They match what most of us have watched happen for 20 years.
Here's what changed. The time to find a flaw like this has collapsed. Researchers at OpenAI, Wiz, and Calif used AI models to prove the PHP flaws were exploitable within weeks, and Chainguard says its team found the same bugs on their own by asking a model to look.
Look at the broader curve. In the last two months, AI models have claimed solutions to problems that stood for decades, and Fields Medalists are issuing public warnings about it. I'm not citing that as proof of anything. It illustrates how fast the capability is moving. METR, which measures how long a task an AI can work through autonomously, estimated in January that the length doubles roughly every 3.5 months for recent models. That's close to ten times a year. That estimate covers coding tasks and may slow down, so hold it loosely. Even a slower curve is fast.
So ask yourself why a hacker wouldn't use the same tools to hack the living daylights out of you. Just because you can't see the hacker doesn't mean they aren't laughing at you right now.
Two documents that fix this
You can't fix how fast the models improve. You own what happens in your environment when they do. Two documents get you there.
The risk register. The CISO's management-by-objectives target should be a risk register the organization can rely on. Every asset is listed. Each one carries an internal risk score, a blast radius, a business owner, a patch schedule, and a priority. The business supports it at 100 percent, and the RED risks get a review every quarter. There better always be some red. A register with no red means somebody stopped looking.
The Currency Chart. The CIO needs a companion document that shows operational risk, not security risk. This is the same horse problem in a different field. It looks like this:
- Oracle is five versions out of date.
- The data in the sales system lacks minimum quality standards and can't be reconciled against the manufacturing or shipping systems.
- This system reaches end of life next year and we don't have finance or project approval to replace it before then.
- The global supply chain has changed what these commodities cost, and we don't have a plan that makes sense for the company.
That last one is live right now. SK hynix said on October 28 that it expects memory demand to exceed supply through 2030. Plenty of analysts expect relief around 2028, but Counterpoint still sees DRAM prices roughly 230 percent above 2025 levels even then, and IDC says memory costs are up about 350 percent in a year. Servers and endpoints are going up beyond what most budgets allow for. I don't see many organizations with a good plan. Most are stretching assets, and stretching assets is a goal. It isn't a plan. Think of the baseball team whose plan is "win the World Series." Sure, that's the goal. Where's the strategy?
What to do Monday
TO CISOs: Make the risk register your MBO. All assets, risk scores, blast radius, owners, patch schedules, and priorities. Get the business to sign up for 100 percent support and a quarterly review of the RED risks. If your register has no red, go find what's missing.
TO CIOs: Build the Currency Chart. Put every end-of-life date, every version gap, every data quality failure, and every supply chain cost problem on one page, with the funding status next to each. Show it to the CFO before the budget cycle, not after.
TO BOARDS: Demand both documents, and fully support them. Instruct the CEO, CFO, CRO, and the rest of the executive team that these are the highest priority. Insist on seeing the full risk register, as far as it can be known. Technology resiliency is essential to the survival of the business and its growth. Fund it like it is.
Map it. Fund it. Review it.