A vulnerability is published on a Monday. You plan the update for the end-of-month maintenance, as usual. By Tuesday, a working exploit already exists, and it wasn't written by a human.
We talk a lot about AI that helps us code. We talk less about AI that helps attack. Yet the past few weeks have produced numbers that are hard to ignore.
A kernel exploit no longer takes weeks
In late October, Anthropic researchers got remote root access on Linux by exploiting the TCP flaw CVE-2026-98432, bypassing the kernel's memory protections. It took them about 53 minutes, with an unreleased AI model (BleepingComputer).
A few days later, OpenAI described a pipeline that produced 1,169 root exploits, covering 948 distinct kernel flaws. Ten days later, only 61 had been fixed upstream (Help Net Security).
This work is done to get flaws fixed, not to exploit them. But it shows what the same technique allows for those without such scruples.
The time between a flaw's publication and its exploitation is now counted in hours.
Attackers have already sped up
On the PHP2Shell flaw, whose story I traced in PHP2Shell: two critical PHP vulnerabilities, from discovery to patch, Unit 42 observed an intrusion carried out by an AI agent in under two hours.
CISA's KEV catalog, which lists exploited vulnerabilities, points the same way: 282 additions since the start of 2026, against 245 for all of 2025. A secondary analysis, which I couldn't cross-check with CISA, puts the median required remediation time at 3 days, against 21 last year.
Patching fast is prepared in advance
For a small IT team, aiming for three days across the whole fleet isn't realistic. But you can get close for what really matters.
- Separate exploited flaws (KEV catalog, vendor advisories) from the rest, and handle the former without waiting for maintenance.
- Start with what is exposed: web servers, VPNs, admin interfaces.
- Plan the reboots: a patched kernel or library protects nothing while the old version is still running in memory.
- Keep recent snapshots so you can update without fear of breaking everything.
- When no fix exists yet, reduce exposure: network filtering, restricted access.
AI doesn't change good practices. It shrinks the time we have to apply them.
And in your team, how much time passes between the release of a critical fix and its installation?
Top comments (0)