The Internet Just Had Its Worst Month in a Decade. What Does It Mean for You?

This month, security researchers disclosed two critical flaws in PHP, the language behind most of the web's backends, and within days defenders were counting exploit attempts in the millions. Attacks began before the patch was even public. Government agencies told organizations to patch immediately or take systems offline. The lesson for business leaders has nothing to do with PHP. The window between a flaw becoming known and being attacked at scale has collapsed from weeks to hours, because both the finding and the exploiting are now done by machines. Security run on human cadence, business-hours response, patch cycles measured in sprints and quarters, no longer covers you. What covers you is what we call standing defense, security run as a standing agent workload that watches, patches, and verifies around the clock, with humans setting its bounds and handling its escalations. The companies that weathered this month already ran that way. Everyone else was reminded why they should.

What actually happened this month?

The most severe web vulnerability in a decade met attackers moving at machine speed.

The two PHP flaws let an attacker take control of a backend server remotely, without credentials, and they affected current versions, not just neglected ones. Maintainers and security firms had been coordinating a patch for weeks after AI-assisted research surfaced the flaws, but knowledge of the exploit started spreading hours before the scheduled disclosure, and major cloud providers later confirmed that attack attempts preceded the public announcement. Within two days, exploit attempts ran into the millions, with attackers racing to compromise servers before administrators could patch. The NSA and CISA issued rare joint guidance urging immediate patching, and a long list of sites simply went dark as a precaution. As of this writing, officials report no confirmed large-scale breach, which sounds like good news until you notice what produced it. The organizations that escaped were the ones that patched within hours. Hours is the new deadline.

What changed about the clock?

Discovery, weaponization, and attack all moved to machine speed, and most companies' response still runs at human speed.

For two decades, the security bargain was that a disclosed vulnerability bought you time. Exploits took days or weeks to build, attackers prioritized rich targets, and a mid-sized company patching within the month was usually fine. AI removed every cushion in that sentence. Models now find flaws that sat undetected for years, the same capability turns a disclosure into a working exploit in hours, and cheap agents scan the entire internet instead of prioritizing targets, so obscurity stopped working as a defense. Every unpatched server is on the list, including yours. Meanwhile the median company still runs security as a queue of tickets handled during business hours by people who are sometimes out of office. That mismatch is the whole story. Your security program was built for attackers on your schedule, and the attackers just left the schedule.

What is standing defense?

Security as a loop that never closes, run by agents you govern, not a project that ships.

We've drawn the distinction before between tasks that end and loops that don't, in loop engineering. Standing defense is that distinction applied to security. It means agents continuously watching your logs, your traffic, and your dependency list, agents testing your own systems for the flaws other people's agents will find, and agents executing the response when a disclosure lands at 2am, rotating credentials, applying patches in staging, and waking a human only for the judgment calls. One operator whose platform survived this month's attacks put it plainly, saying the only reason they were surviving was agents running around the clock. That's not a tech-company luxury. The same week as the PHP disclosure, attackers breached hosting platforms to steal stored API keys, and the companies that rotated every key across every project within hours did it with agents. By hand, that job takes a week you don't have.

Doesn't this just mean spending more on security?

It means moving security from a project line to a standing line, and it's a cost you were already going to pay.

Standing defense is a row on the control bill, the half of every AI budget that buys trust rather than capability, and it behaves the way that bill behaves. Funded deliberately, it amortizes, because the monitoring, identity, and response infrastructure you stand up protects every system you run and every agent you deploy afterward. Funded by incident, it arrives as a fine, plus downtime, plus the forensic work of figuring out what the intruders saw. Two cautions as you fund it. Defense agents act on your most sensitive systems, so they need scoped identity and permissions of their own, the discipline we described in the agent badge. And finding problems was never the hard part. The capacity to act on findings is, which is why standing defense has to include the fix-side plumbing we covered in the remediation ceiling, or you've built a smoke detector for a building with no sprinklers.

We're not a tech company. Does this really apply to us?

Yes, because your exposure lives in the stack you rent, not just the code you write.

Your website, your commerce platform, your booking system, and half your vendors run on the same shared infrastructure these waves hit. When we wrote about the cybersecurity shift after the Mythos release, the argument was that AI-scale vulnerability discovery would change the ground under every business, not just the technical ones. This month is what that looks like in practice. A non-technical company's version of standing defense is smaller but real, an agent that watches disclosures affecting your actual stack, a current inventory of what you run and through whom, patching authority that doesn't wait for Monday, and vendors you've actually asked about their own response speed. The question that matters in your next vendor review has changed from whether they've had an incident to how fast they close one.

What should you do about it?

The question leaders are really asking after a month like this is whether they need to become a security company to stay safe. You don't. You need to accept that defense is now a standing workload and staff it the way the attackers do, with agents on the loop and people on the judgment. Ask your security lead, or your managed provider, what happens in the first six hours after a critical disclosure if it lands on a Saturday night. If the honest answer involves waiting for a human to start their shift, that gap is the project. Fund the standing layer, give its agents proper badges, and wire the fix-side capacity to match, because this month was not an anomaly. It was the new tempo announcing itself.

If you want your exposure mapped and a standing defense scoped to your actual stack, start with an AI Blueprint or reach us at contact@theyor.com.