A single vulnerability can trigger a global domino effect across borders and industries within hours. The recent critical vulnerabilities in PHP illustrate how a weakness in a shared technology can expose organisations worldwide to the same threat simultaneously. Having a patch available is essential. Turning it into effective protection requires qualified professionals, clear responsibilities and the operational readiness to act.
On 21 October, European authorities issued a joint warning about two PHP vulnerabilities that could allow attackers to execute malicious code remotely on vulnerable servers without authentication. While security updates have been released, the warning highlights a particularly difficult challenge: some organisations may not even realise that the products and services they depend on use PHP. Authorities have urged businesses to identify affected applications, coordinate with providers and prioritise internet-facing systems.
For many businesses, the greatest vulnerability may be a dependency they do not know exists. A company can have robust internal security procedures and still be exposed through a supplier, an application or a component buried several layers into its technology infrastructure. The challenge is no longer simply protecting the systems an organisation owns, but understanding the systems it depends on.
AI adds a new dimension to this challenge. It can help security researchers identify weaknesses more efficiently, but faster discovery does not automatically translate into faster protection. Organisations still need to assess findings, make decisions, coordinate with suppliers and implement changes. If those processes cannot keep pace, advances in vulnerability discovery may expose an increasingly significant gap in organisational readiness.
From an alert to an accountable response
For business leaders, the immediate question is whether their organisation can establish its exposure and demonstrate that it has addressed it. A company may receive assurances that its external provider has updated a customer portal. But what does that assurance cover? The production environment, a secondary server, the disaster recovery environment? Who checks whether other applications share the same dependency?
These questions illustrate why vulnerability management needs clear ownership and reliable evidence. Technical teams must implement and test corrections. Security managers must assess priorities, coordinate resources and communicate the implications for the business. Auditors must independently evaluate whether the controls supporting that response are adequate and operating effectively.
The challenge is compounded by the pressure already facing cybersecurity teams. According to ISACA’s State of Cybersecurity 2026 research, 56% of European respondents report that their organisations’ cybersecurity teams are understaffed, while 55% say they are underfunded. These constraints can make it harder to investigate exposure, coordinate remediation and verify that security fixes have been implemented effectively.
Building resilience before the next alert
Cyber resilience must be built before a crisis hits. An accurate inventory of assets and dependencies, established supplier contacts and procedures for urgent changes give teams a foundation for action. They also need to know how to verify remediation and manage disruption if a service must be temporarily isolated.
Business leaders determine whether those capabilities receive sufficient investment. They must ensure that teams have the resources and authority to act, that unsupported systems receive attention and that significant risks reach the people empowered to address them. Preparedness should be tested through exercises and reviewed after real incidents.
That investment must also extend to the next generation of cybersecurity professionals. As AI accelerates vulnerability discovery, defenders need the skills to use it responsibly to identify weaknesses, assess findings and support remediation. Continuous learning, technical experience and professional judgement will be essential to translating that speed into better protection.
Technology will never be completely free of vulnerabilities. The real test is whether organisations have the governance, expertise and operational readiness to prevent a software flaw from becoming a wider business crisis. In an interconnected economy, the quality of that preparation has consequences far beyond any single company.
This is a contributed article by Chris Dimitriadis, Chief Global Strategy Officer, ISACA. For more information about ISACA, you can go here.