“Are we exposed?” CIOs and CTOs heard that question all last week. On Tuesday, PHP shipped emergency fixes for two pre-authentication remote code execution flaws that date back to 2004. By Wednesday, Palo Alto Networks said every supported version of PAN-OS and Panorama was vulnerable and no fix was available. Cisco was reviewing 18 products and 13 cloud services, and Fortinet was reviewing eleven. NSA, NCSC and CERT-EU told operators to take unpatched systems offline, and Cloudflare’s CEO watched exploit attempts jump from thousands to millions within hours. People are calling it Black October.
An AI model found most of these bugs. The lesson for boards, though, isn’t about AI. Patching is no longer the bottleneck. Knowing where to patch is.
“Please go to your boards and ask for help right now. Not for AI, for the basics.” (Jason Clinton, Deputy CISO, Anthropic, Oct. 22.) Marc Benioff replied: “Jason is 100% right. Code red.”
Answering “are we affected?” should take minutes. That takes one real-time, authoritative record of every device, version, site, owner and exposure, plus automation that patches from that record and confirms the fix. Organizations without that record are still searching while attackers move. With vulnerability volume climbing this fast, the gap will only grow.
The number of vulnerabilities has more than doubled in the last year – and it is just getting started
From January 1 to October 13, 79,680 CVEs were published, 2.15 times the same period in 2025. Microsoft alone published 1,408 on October 13. That’s more than it disclosed in all of 2025, and its fourth record month in a row.
AI is behind the surge. Between April and July, Anthropic’s Project Glasswing partners verified more than 129,000 vulnerabilities, over 33,000 of them critical or high, and Anthropic estimates the real total is at least five times higher. Google’s threat intelligence group says monthly disclosures doubled from January to August, and that AI-found bugs are twice as likely to be remote code execution. OpenAI, whose model found the PHP flaws, expects such findings to “increase sharply in the coming months.”
Exploitation is speeding up just as fast. Mandiant’s mean time-to-exploit for 2025 was negative seven days, and Microsoft puts median discovery-to-weaponization under 24 hours. Amazon CISO CJ Moses saw PHP2Shell probing four days before a patch existed. His warning: the disclosure date isn’t the earliest date of exploitation. Reuters reported that one operator used AI agents to breach more than 100 companies for about $5,000 in tokens. That works out to roughly $50 a breach.
Attackers can’t be allowed to have a better asset inventory than you do
Enterprises simply aren’t keeping up:
- Verizon’s 2026 DBIR found just 26 percent of known-exploited vulnerabilities fully remediated, down from 38 percent, with a median of 43 days.
- Moody’s puts the median at 87 days for exploited bugs.
- Tenable found Citrix environments take a median of 461 days to patch.
The patch itself is rarely the obstacle. The obstacle is systems nobody knew about. As Armis’s threat intelligence lead put it this week, “the most common gap is not knowing an instance exists.” PHP is built into firewall consoles, NAS admin panels, printers, cameras and switches that never advertise it. Action1’s field CTO said it more bluntly: “The inventory is a guide, not a shield.” Most enterprises don’t even have the guide.
Two incidents this month show the stakes. On October 16, Palo Alto’s Unit 42 disclosed that attackers who compromised FortiManager instances got an inventory of more than 500 downstream FortiGate firewalls, including serial numbers and public IPs, and used it to gain root on those firewalls. In the Reuters case, when the target application had no flaw, the agents moved to adjacent infrastructure and found an exposed control panel nobody was watching.
AI now finds the bug, writes the exploit and maps your estate faster than your team can. The defender’s one lasting advantage is knowing the estate better than the attacker: every device, version, exposure and owner. That knowledge has to drive action in hours, not quarters.
Network and infrastructure is the front line
The hardest systems to see are the ones getting hit hardest. Google reports that edge and security appliances accounted for 14 percent of exploited vulnerabilities this year, and two-thirds of those were high or critical. Mandiant notes these devices usually lack standard EDR telemetry. In October, actively exploited flaws hit Ivanti Connect Secure, Cisco Secure Email Gateway, Palo Alto PAN-OS, Fortinet FortiMail and FortiOS, SonicWall SMA and Citrix NetScaler. Then PHP2Shell exposed the management plane of nearly every major network vendor at once.
You can’t put an agent on a router or scan what isn’t routable. That’s true across the campus, the branch and edge, the AI data center and the OT floor. The control that works there is an accurate, current record of what’s deployed, what it runs, where it sits, who owns it and whether it’s reachable from the internet, plus automation that acts on that record.
This is a board question now
Every board should ask its infrastructure leaders five questions this month:
- Do we have a single, continuously updated inventory of every network device, server and appliance we operate — with software version, location, owner and internet exposure?
- When the next PHP2Shell lands, how long does it take us to answer “which of our systems are affected”? Minutes, or weeks?
- Is that inventory discovered from the live network, or is it a spreadsheet someone updates when they remember?
- Can our automation patch directly from that inventory, or does every advisory start with a manual hunt?
- After we patch, do we verify the fix took and the estate hasn’t drifted?
If the answers are no, weeks, spreadsheet, manual and no, the problem isn’t patching. It’s a gap in the fundamentals, and no patch-management budget will close it.
What to do this quarter, not next year
Treat this as a loop that runs continuously, not a project with an end date:
- Discover. Find everything on the network automatically, all the time. Unknown devices are the attacker’s favorite devices.
- Record. Put it in one system of record: the intended state of your infrastructure, not a scan export. Version, role, site, owner, exposure.
- Prioritize. Join that record against KEV and vendor advisories. Internet-reachable plus critical plus exploited goes first. The rest is a queue, not a panic.
- Patch from the record. Drive automation off the inventory so a new advisory becomes a targeted job, not a scavenger hunt.
- Verify and repeat. Confirm the live state matches the intended state, catch drift, and go again. Forever.
Automation helps teams keep pace, but without an authoritative inventory, it just misses things faster.
Attackers now discover at machine speed, while remediation still moves at the speed of someone opening a spreadsheet. Until that changes, attackers will know your infrastructure better than you do. Fix that first, and fix it this quarter.