The patch era just went machine-speed, and quarterly cycles are dead

What happens when finding a bug gets cheaper than fixing it? We just got a live demonstration, and it wasn't pretty. Governments took sites offline, and the people running the internet's plumbing spent the week in triage mode.

The short version: two critical flaws in PHP, which AFP notes runs a large share of the world's websites, were found with AI models. As L'Express reports, government sites in Europe and elsewhere went offline as a precaution while operators rushed to patch. Two security firms, Calif and Wiz, reported finding the bugs independently, and Wiz said it used OpenAI and Google models. The bugs had sat in the code for years.

Our view is that the flaws themselves matter less than what they show. Discovery now moves at machine speed. Most organizations still patch at human speed.

The scary part isn't the bug, it's the clock

Michael Daniel, president of the Cyber Threat Alliance and a former White House cybersecurity coordinator, gave AFP the figure that stuck with us. It used to take a month or two for a proof of concept to come out, and then another month or two for it to show up in exploit kits. Now, he says, that's measured in hours or days.

Look at what that does to a quarterly patch cycle. If the gap between a flaw going public and attackers using it shrinks to hours or days, a process built around monthly maintenance windows is, in our view, a decision to be exposed. The Reuters investigation summarized by Distributique says VulnCheck data show the number of discovered vulnerabilities doubling in a year. Doubling the inbound volume while the response window collapses is a squeeze that headcount probably can't fix.

We should be fair about the caveats, though. Daniel notes that only five or six percent of vulnerabilities have historically been exploited, and nothing suggests that share is rising. On this particular flaw, the reports conflict. Researchers cited by Distributique said that, at the time of the Reuters investigation, no working exploit had been confirmed. L'Express, for its part, reports that tech companies warned some hackers were already exploiting the flaws. We can't settle that from here. Our read is that this is first a speed problem, and that claiming the internet is already burning is overselling it. Shrugging it off would be worse.

"Test everything for weeks" was a luxury, not a policy

The most uncomfortable idea in Daniel's interview is about risk tolerance. Most businesses ran what he calls a zero-risk tolerance for breaking things, so they tested patches exhaustively. He argues they no longer have that time. If a patch has a one percent chance of breaking something, but an attack could cost $50 million, the trade-off changes.

We think he's right, and many IT departments won't like hearing it. Slow, careful patching was rational when exploitation was slow. Now the cost of waiting is the bigger risk. In practice, that means three unglamorous things. First, an accurate inventory of what you run, and which of it faces the internet. Second, automated test-and-deploy paths that can ship a fix fast. Third, temporary mitigations for when a patch can't go out immediately. That's roughly the checklist Distributique's piece lays out, and none of it needs AI. It needs discipline, which is harder.

Small organizations are the real losers here. Daniel's advice for them is blunt: shift the organization so it can accept vendor updates as fast as possible. For anyone on a managed platform, that mostly means choosing vendors by how quickly they patch.

Tech debt is the real story, and AI is the collection agent

Daniel talks about our "tech debt coming due." The implicit cost of keeping old software never shows up on the books until an episode like this one. Rob Joyce, the former NSA cybersecurity director, has called it the "great cleansing forest fire of old software." Both framings land with us.

There's also a hopeful reading. Daniel expects AI tools to be turned on software before it's deployed, so new code starts with fewer holes. Jason Clinton, an Anthropic security executive, wrote on X that things will get much worse before they improve and that we need to hold on for about 18 months, according to 01net. That's a forecast, not a fact, and it comes from a company that builds these models. Still, the logic is plausible: defenders eventually get the same tools.

One more caution is the noise. Daniel is candid that many AI-reported findings are false alarms or sit in software never exposed to the internet. Triage, not discovery, looks like the bottleneck.

Our verdict

Stop treating this as a PHP story. Treat it as a stress test of your patch pipeline, and ask honestly how long a critical fix would have taken you this week. If the answer is "weeks," that's the project for next quarter, not the next patch cycle. Inventory what you run, automate the deploy path, accept a small risk of breakage, and retire software you've been keeping alive out of inertia. The flood Daniel describes is coming either way. The only choice is whether you've built a spillway.