The critical PHP vulnerabilities disclosed earlier in October are a stark reminder that a single flaw can trigger a global domino effect across borders and industries within hours, leaving organisations worldwide exposed to the same threat at once.
Having a security patch available is essential. However, a patch is not a silver bullet solution. Turning patches into effective protection demands qualified professionals, clear responsibilities and the operational readiness to act.
You can’t protect what you don’t know
On 21 October, when European authorities issued a joint warning about two PHP vulnerabilities that could allow attackers to execute malicious code remotely on vulnerable servers without authentication, another issue was highlighted.
While security updates have since been released, organisations were forced to confront the fact that they hadn’t even realised which products and services depend on PHP. Authorities have urged businesses to identify affected applications, coordinate with providers and prioritise internet-facing systems. But unfortunately, cyber resilience isn’t something organisations can switch on when a crisis hits.
For many businesses, their greatest vulnerability may be a dependency they do not know exists. As we’ve recently seen, a company can have robust internal security procedures and still be exposed through a supplier, an application or a component buried several layers into its technology infrastructure. The challenge is no longer simply protecting the systems an organisation owns but also understanding the systems it depends on across its entire supply chain.
From an alert to an accountable response
For business leaders, the immediate question is whether their organisation can establish its exposure and demonstrate that it has addressed risk across its entire supply chain. A company may receive assurances that its external provider has updated a customer portal but have they checked whether the company’s other applications rely on the same vulnerable components?
Vulnerability management is a critical role in any business, and it needs clear ownership. Patching fast when vulnerabilities are identified is a challenge, especially as AI is increasing the pace of such identification. Technical teams must implement and test corrections in relation to the application and local architectural context for ensuring smooth operation after patching. Security managers must assess priorities, coordinate resources and communicate the implications for the business. Auditors must independently evaluate whether the controls supporting that response are adequate and operating effectively.
While these roles are critical, increased demand for security oversight is further weighing down stretched cybersecurity teams. In September, ISACA’s State of Cybersecurity 2026 research found that 56% of European respondents report that their organisations’ cyber security teams are understaffed, while 55% say they are underfunded. These constraints can make it harder to investigate exposure, coordinate remediation and verify that security fixes have been implemented effectively.
In an environment that only gets more complex, cyber security professionals are expected to do more work, faster, and with small teams. Increased investment is non-negotiable if organisations want even basic cyber security.
Building resilience before the next alert
Cyber resilience must be built before a crisis hits. An accurate inventory of assets and dependencies, established supplier contacts and procedures for urgent changes give teams a foundation for action. They also need to know how to verify remediation and manage disruption if a service must be temporarily isolated.
Business leaders should determine whether those capabilities receive sufficient investment. They must ensure that teams have the resources, skills and authority to monitor for vulnerabilities and act when needed. Unsupported systems must receive attention and processes must be introduced so that significant risks reach the people empowered to address them. Preparedness should be tested through exercises and reviewed after real incidents.
Investment must also extend to the next generation of cybersecurity professionals. As AI accelerates vulnerability discovery, defenders need the skills to use it responsibly to identify weaknesses, assess findings and support remediation. Continuous learning, technical experience and professional judgement will be essential to translating that speed into better protection.
Technology will never be completely free of vulnerabilities. The real test is whether organisations have the governance, expertise and operational readiness to prevent a software flaw from becoming a wider business crisis. In an interconnected economy, the quality of that preparation has consequences far beyond any single company.
Chris Dimitriadis is global chief strategy officer at ISACA
