PHP flaw exposes shrinking window to patch software

Cybersecurity experts estimate that widespread exploitation could begin within 15 minutes of an update's release, although the precise window depends on the vulnerability and the availability of working exploits. CERT-In issued a critical-severity advisory, urging users to apply the relevant security updates. “Attackers can move within hours, while organisations sometimes take weeks to respond,” Mayank Morya, co-founder and chief technology officer of cybersecurity firm Mitigata, said.

He added that the PHP flaw had reportedly existed for nearly 14 years, while researchers spent weeks developing a fix. Once technical details became public, however, attackers could begin working on exploits much faster. The growing use of artificial intelligence in vulnerability discovery and exploit development is adding to the pressure on security teams. AI-assisted tools can help researchers identify weaknesses in large codebases and potentially accelerate the development of attacks, leaving defenders less time to assess their exposure and respond.

“With registered vulnerabilities reaching an unprecedented level in Q2 2026, driven largely by AI-assisted flaw hunting, weaknesses like this are now found in minutes,” he said. Chris Yule, senior director of threat research at Sophos Counter Threat Unit, said AI was accelerating the weaponisation process and narrowing the window available to defenders. However, the challenge for businesses is not limited to how quickly an exploit is developed.

They must also establish whether they run the affected software, identify exposed systems and apply fixes without disrupting operations. “The immediate challenge is not simply installing a patch, but finding and managing every instance where PHP is running,” said Don Smith, vice-president of threat intelligence at Sophos Counter Threat Unit. PHP is widely used across websites, content management systems, hosting platforms and third-party applications, making it difficult for organisations to maintain complete visibility, particularly when infrastructure is managed by external service providers.

Older systems and appliances pose a further challenge because they may not be easily updated or replaced, while some depend on vendors for security fixes. Smaller businesses may also be unaware of which PHP versions their hosting providers run, leaving vulnerabilities unaddressed even after patches become available. Sanjeev Singh, partner at Deloitte India, said businesses needed better visibility into their IT assets, faster patch deployment and continuous monitoring to detect potential compromises and limit disruption where immediate updates were not possible.

Experts said organisations also needed accurate software inventories, clear responsibility for patching and contingency plans for systems that could not be secured immediately.