How should security teams prioritise the flaws AI finds?

On 21 October 2026, researchers disclosed two critical flaws in PHP, with AI playing a significant part in finding them. Coverage highlighted PHP’s use by around 70% of the world’s websites. That describes how widely the software is used, not how many systems are exploitable.

We should expect more discoveries like this. AI can examine code and investigate potential attacks at a pace that would be difficult to match manually.

The challenge is turning those discoveries into a response that fits the organisation’s exposure, without disrupting the business or letting headlines dictate the priorities.

More findings make prioritisation more important

The PHP flaws arrived with numbers that naturally attract attention. A Common Vulnerability Scoring System (CVSS) rating above nine is going to make security teams look, and rightly so.

But a severity score alone can’t tell you how urgently you need to act. You also need to know:

• Whether you run the affected software and version
• Where it sits
• Whether it is exposed
• Which identities have access
• What privileges are involved
• Whether exploitation has been observed
• What could happen if you apply the fix

Those weaknesses also need to be considered together. A flaw that appears less serious on its own may become a route into a system when combined with another weakness. AI can help investigate those connections, so prioritisation needs to consider possible attack paths, not just individual scores.

That is familiar vulnerability management, but it becomes more pressing when machines can find flaws faster than organisations can investigate and remediate them.

We can’t treat every new critical vulnerability as an emergency. Nor can we assume that a technically difficult exploit is harmless. The PHP vulnerabilities themselves demonstrate why. Exploitation was subsequently observed in the wild.

Headline-driven urgency can make that assessment harder.

Requests for exposure briefs and leadership statements can take people away from investigating and patching systems. Communication should support the response: is the organisation exposed, what action is needed and when will the next update come? The reach of a headline is not a measure of risk.

Use AI to support decisions, not just accelerate the work

AI can help assemble the evidence: details of affected systems, exploitation and possible fixes. Teams can also use it to investigate their own code and identify how weaknesses might combine, rather than waiting for the next disclosure.

The same tools can help prepare patches and tests, and automate familiar fixes.

But producing a fix is not the same as deciding to deploy it. Someone still has to judge whether the risk justifies an immediate change, whether a temporary measure is safer, or whether to wait for a planned deployment.

The people held accountable do not always control the time, resources or approvals needed to respond. A fix being available does not remove those constraints. Leaders need to match expectations to the team’s capacity and provide the business context, authority and clear decision routes to act.

Make good decisions easier to act on

Keeping up cannot mean working harder every time discovery gets faster. It means reducing what needs defending and making safe changes routine.

Start by reducing unnecessary exposure. Removing an unused endpoint or route means one fewer place an attacker can look for a way in. A clear view of the systems supporting important services helps teams decide what can be removed.

That view needs to include runtimes, not just application packages. Dependencies are only part of the picture: teams also need to understand the software running their applications, where it is deployed and which identities can access it.

Then make patching predictable, with standard deployment templates, tests the team trusts and a repeatable route into production. Practise runtime changes before an urgent vulnerability puts the process under pressure. A quickly generated fix offers little advantage if nobody is confident deploying it.

Use AI to investigate your own systems, too. If models can help find connections between weaknesses, put that capability to work before an attacker does. The aim is to make investigation and remediation part of a repeatable process, not another demand for exceptional effort.

None of this makes an organisation invulnerable.

Faster discovery is becoming part of normal operations, and the response needs to be automated where possible, routine and well rehearsed. What still needs human attention is deciding promptly, communicating calmly and being willing to reduce what needs defending.