1/3 It’s been an eventful week for software security. Serious vulnerabilities in widely used software like PHP and Node.js, new evidence of what advanced AI models can discover, and no shortage of security vendors offering solutions. AI is making vulnerabilities easier to find and increasingly easier to exploit. That raises the stakes for every company running software. Consider what happens when a new vulnerability is disclosed. Security teams have to identify every affected application. Engineering has to update dependencies or code, run tests, clear release controls, deploy, and verify the fix is live. In a large enterprise, that work spans thousands of applications and millions of dependencies, much of it in software the company didn’t write. As models get more capable, the volume of findings will grow and the time attackers need to act will shrink. Our ability to safely deploy fixes is already struggling to keep up. Network defenses, SOC automation, and virtual patching are essential to contain threats while engineering teams work through remediation. But we still have to fix the underlying software. We need to fundamentally rethink how we secure and maintain software in an era of machine-speed attacks.

PHP2Shell guidance for GitLab customers: how to find and auto remediate. Attackers are using agents, you should too. about.gitlab.com/blog/gitlab…