By Mark Kuhr, CTO, NetSPI + Synack, and Nabil Hannan, Field CISO, NetSPI + Synack
On October 21, government websites across Europe went dark. Dutch, French, Danish, and Finnish agencies took public-facing services offline after critical vulnerabilities surfaced in PHP, the programming language behind approximately 75% of websites. The flaws had been sitting in the codebase for years until AI tools uncovered them.
Although a fix has been shared publicly, AI has made it easy for attackers to reverse engineer what changed. Amazon reported that its security team saw an exploitation attempt against a honeypot system on October 17, four days before the disclosure. Defenders were behind even before the advisory went out.
Yesterday, we covered the technical details of the PHP2Shell vulnerabilities, and in this post, we’ll answer the broader questions security teams are asking about how this story illustrates the new normal in offensive security.
1. How Are Attackers Moving Faster Than Defenders Can Patch?
AI has made discovery cheap and fast while remediation still depends on people, testing, and change windows that have not sped up at the same rate.
Mandiant’s M-Trends 2026 research estimates that mean time to exploit has dropped to around -7 days, which means exploitation often begins before a patch exists. Attackers also have little process to slow them down. They do not need change approval, regression testing, or maintenance windows.
We expect this to intensify. Vulnerability volume has been climbing for years, and AI-driven discovery will push it higher. That puts pressure on the entire find-and-fix cycle, and patch timelines measured in weeks are increasingly out of step with adversaries who run automated agents around the clock. That is especially true for legacy systems, operational technology, and hardware that cannot tolerate an unscheduled reboot.
2. Is Our Testing Program Keeping Pace with AI-driven Attackers?
For most organizations, probably not, and the gap is as much about coverage as speed.
Point-in-time and compliance-driven testing leave long stretches between assessments, and attackers do not wait for an audit cycle. Customer data shows progress on speed: Synack customers reduced the time to remediate critical vulnerabilities from 63 days to 38. Yet only about 32% of the attack surface in that data is tested at all. Fixing known issues faster does nothing for the 68% that nobody has examined.
Scope is another common culprit. Many organizations maintain asset inventories that are out of date or incomplete, so the scope they hand to testers leaves out systems they aren’t aware of. Testing should follow how adversaries operate, including production environments where the risk is understood. Over-restricting a test because it touches production often costs the organization the most valuable findings. Going a step further, continuous pentesting provides a steady flow of verified signals instead of an annual snapshot.
3. How Do We Prioritize What to Fix First When AI Finds More Than We Can Handle?
Prioritize by exploitability and business context rather than severity score alone. We’ve heard from security leaders that finding more vulnerabilities doesn’t necessarily help the team if they don’t have the capacity to fix known issues.
They now have to shift their focus to prioritizing risk, and that requires context. Start asking:
- Which assets are exposed to the internet?
- Which hold sensitive data?
- Which connect to something that would enable lateral movement?
A reliable internal asset inventory, paired with an understanding of which security controls cover each asset, shows which fixes reduce proven risk. A medium-severity flaw on a critical, reachable system can matter more than a high-severity one on an isolated server.
4. What’s the Ideal Combination of Humans and AI for Offensive Security?
People should provide context, creativity, and accountability, while AI handles reconnaissance and discovery at scale. AI often still struggles with business logic flaws, chaining weaknesses into a real attack path, and judging whether a finding matters in a specific environment. False positive rates for AI-driven detection remain high enough that unvalidated output can bury a team in noise. Public reporting on AI-discovered vulnerabilities also shows that experts frequently guide the models and shape how an exploit is built.
The same is true on the attacker side. Adversaries are people directing AI toward their goals, and defenders need to test with equal creativity. In our own engagements, expert assessors guide exploit development and use AI tools heavily, and every result is validated by a person. Guardrails matter too. When offensive AI runs inside a production environment, it needs clear rules of engagement and scope limits, plus people watching what it does.
5. What Should Security Teams Do This Week?
Start with the immediate PHP exposure, then use it to test your wider program.
- Inventory every system that runs PHP, including content management systems and third-party applications, and identify who owns each one.
- Confirm patch status and apply the fixes, prioritizing internet-facing assets.
- Test exposed systems for exploitability so you know what an attacker could potentially reach.
- Decide in advance which findings should trigger immediate action, so the next disclosure does not start with a debate.
- Move your most critical assets from annual testing to a continuous model.
The PHP shutdowns will not be the last event of this kind. Discovery will keep accelerating, and the teams that fare best will be the ones that know their attack surface, test it continuously, and focus limited remediation capacity on what matters most. NetSPI+Synack works with security teams to keep pace so there’s nothing left to exploit.
##
ABOUT THE AUTHOR
Mark Kuhr is the Chief Technology Officer of NetSPI+Synack where he leads the engineering, operations, and product teams, overseeing the development and delivery of the penetration testing platform and Sara AI Pentesting. Mark co-founded Synack and has spent more than 20 years in the cybersecurity industry. Prior to Synack, he worked at the National Security Agency as a cyber operator and the Defense Information Systems Agency (DISA). Mark holds a Ph.D. in Computer Science from Auburn University earned under a DoD/NSA-sponsored fellowship.
Nabil Hannan is the Field CISO of NetSPI + Synack, where he advises strategic clients and executive teams on their cybersecurity needs. He brings more than two decades of cybersecurity consulting experience, with expertise in software security and the financial services sector. His work includes AI in offensive security, continuous security validation, and helping organizations prioritize vulnerabilities based on business risk. Previously, he held roles at Cigital/Synopsys and served as a Product Manager at Research In Motion/BlackBerry.
