The Expanding Attack Surface Demands a New Operating Model | Qualys
Summary: Qualys' Threat Research Unit found more than 166 million PHP installations across over 10,000 customer environments, roughly three-quarters of them internet-facing, and observed attack activity within hours of the October PHP2Shell disclosure while only a small percentage were patched in the critical first hours. Qualys attributes the compression of disclosure-to-exploitation time to frontier AI reducing the effort for reconnaissance, vulnerability analysis, attack planning, and exploitation, and says its Enterprise TruRisk Management platform now ingests telemetry from Lookout and NowSecure for mobile and from Claroty and Nozomi Networks for OT, IoT, healthcare, and cyber-physical environments.
What you should know: Three-quarters of 166 million PHP installations were internet-facing, and attackers were active within hours of disclosure while patching lagged - a window that frontier AI keeps narrowing. The mobile, OT, and medical devices now in scope are often run by separate teams with separate severity models, but attackers see one attack surface.
Read the original at Qualys Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026