86.7% of exploited CVEs are now zero-days: Kurtz on why PHP2Shell ends the patching window
joshua_saxe · x · 2026-10-23
CrowdStrike CEO George Kurtz offers three takeaways on PHP2Shell: (1) PHP maintainers spotted the underlying bug in 2024, but only AI-assisted research proved exploitability — what's impractical to exploit today may be exploitable tomorrow as models advance; (2) much of the web runs out-of-support PHP versions, so remediation will have a very long tail with downstream breaches for months; (3) the patching window has collapsed — an a16z chart citing Zerodayclock shows the share of exploited CVEs exploited on or before disclosure day rose from 18.7% in 2018 to 86.7% in 2026.
More from AGI Musings
- Beff and Ashe Talk Techno-Optimism: How Society Should Navigate the AI Transition — beffjezos · 2026-10-23
- Embodied AI Makes Authority Physical: Robots Need an Inspectable Execution Trail — tallmetommy · 2026-10-23
- Chinese AI labs embrace 'recursive self-improvement' — but the story is bottom-up, not state-coordinated — Afinetheorem · 2026-10-23
- AI researcher: even dumb models are now powerful hacking tools, sparking an AI cyber arms race — Yuchenj_UW · 2026-10-23
- Non-programmer in his 50s built a full property dashboard with Codex controlling all his smart homes — craigsdennis · 2026-10-23
- Headless everything: why the frontend is sacrificial in the era of personal AI agents — genmon · 2026-10-23