Last week two critical flaws surfaced in PHP, the language behind most of the web. Attackers were testing exploits before a fix existed. When patches shipped, the question became: how fast can you apply them? By then, the race was already well underway.

This isn’t really a story about PHP. It’s a story about speed. For years, the perimeter was a wall. Today, it’s a clock. The defender's window is the new perimeter.

Two things work against that window. Attackers now move faster than patches. And patched isn’t clean: a patch closes the door, but doesn’t tell you who already walked through, or what they left behind.

The Window is Shrinking

Not long ago, defenders had time on their side. A flaw was disclosed, a patch shipped, and teams had enough time to test and roll it out before attackers could act.

That time is gone.

AI is shrinking the time between discovery and exploitation even further. CrowdStrike’s fastest recorded breakout: 27 seconds.

Meanwhile, patching still moves at human speed. Every system has to be found, tested, scheduled and restarted, and some can’t be patched at all. 

Patched Isn’t Clean

Patch fast, every time. But no organization can patch its way to safety in a world this fast.

With PHP2Shell, attackers had days before the fix to plant backdoors or quietly compromise passwords and keys. The patch removes neither. Your systems show “up to date,” and the attacker still has a way in.

Patched isn't clean. The incident isn’t over when the fix is deployed. It’s over when you can prove you’re clean.

Three Questions for Every CEO

Every leadership team should be answering these questions today:

• Did attackers get in before we patched?
• Did they reach our credentials or our data?
• Which version of our critical systems can we trust, and how fast can we get back to it?

And for the longer term the question is: what’s our strategy going forward? 

Most organizations can’t answer those quickly. They comb through logs, rebuild timelines by hand, and too often restore and hope, while the business waits.

Resilience is How You Win the Race

Everything we do to keep attackers out still matters. All of it is necessary. None of it is enough on its own anymore. 

Something will get through. You can’t out-prevent all of it. You have to out-recover it.

That’s what resilience means: assume breach, and be ready to prove what’s clean and bring the business back at machine speed. 

It starts with one question: if everything went down tomorrow, what would you need back first to keep going? Call that your Minimum Viable Business. Identity, so people can log in. Communication, so teams can coordinate. Then the applications that keep business operations running. Define it, protect it, and rehearse bringing it back.

And if you’re working through this vulnerability now, start with the systems on that list. Our team has published a technical guide on using Rubrik to hunt for indicators of compromise.

The defender's window is shrinking. We can’t count on preventing every compromise. We have to prove we can withstand one and recover from it.