Cogent Security research published November 3, 2026; PHP2Shell disclosed October 21, 2026
PHP2Shell by the Numbers: The Average Fortune 500 Firm Had Patched Under 1 Percent of Affected Assets by End of Day One
New figures published November 3 by Cogent Security, an applied AI security company, put a measurement on the response gap that PHP2Shell exposed. PHP2Shell, disclosed October 21, is a pair of critical flaws that had sat in PHP for more than a decade; by Cogent's account, AI-assisted research helped identify the flaws and develop working exploits in about one week, attacks began before a patch was available, and Cloudflare recorded millions of exploitation attempts on the disclosure day. Against that tempo, Cogent's research found that by 5 p.m. Pacific on day one, the average Fortune 500 company had patched fewer than 1 percent of its 2,266 affected assets. The same analysis shows why the raw count misleads: when Cogent's tooling checked which of those 2,266 assets actually had PHP loaded at runtime, faced the internet and supported critical business functions, the urgent list fell to 16. Cogent also cites Google's M-Trends 2026 estimate that mean time to exploit now sits at negative seven days, meaning exploitation routinely begins before a fix exists, and research showing AI producing working exploits for newly published flaws in about 15 minutes at roughly a dollar apiece. These figures come from Cogent's own research published in its November 3 release, which also announced the company's second consecutive appearance on the Fortune Cyber 60 list; they are vendor measurements, published to support its autonomous defense platform, and are best read as a directional account of enterprise response speed rather than an independent census.
Executives
Hold the two numbers together: under 1 percent patched by end of day one, and 2,266 raw assets narrowing to 16 that were actually reachable and critical. The first number is the risk, the second is the method. Response speed on a day-one flaw is decided before the flaw exists, by whether the organization can produce a runtime-verified, internet-facing shortlist in hours. That capability, however it is built, is the investment this data argues for, and it is squarely the Identify and Protect work of the NIST framework applied to vulnerability management.
CIO / CISO
Measure your own PHP2Shell timeline honestly: when did the advisory reach a named owner, when was the exposed subset known, and when was the fix verified by rescan rather than by ticket closure. If any of those answers is measured in days, the fix is procedural: a pre-authorized emergency path for KEV-class and day-one flaws, an asset record that knows what is loaded at runtime rather than merely installed, and grouping of remediation by fix so one patch closes dozens of assets at once. Cogent sells automation for exactly this; the underlying discipline is vendor-neutral.
Engineers
The 2,266 to 16 reduction is a filtering exercise you can run with existing tooling: installed package data joined against running process and listener data, internet exposure, and business criticality. Build that join now, while there is no clock running, and keep it refreshed. When the next disclosure lands, the teams that start from the shortlist finish first, and the rescan that confirms the fix is part of the same record, not a separate chore.
Everyone (non-IT)
This story is about how fast big companies fix dangerous software flaws, and the honest answer in this measurement is: much slower than the attackers who exploit them. It does not ask anything of you directly, unless you run a website or a server of your own, in which case the lesson scales down cleanly: turn on automatic updates, and know which of your systems are reachable from the internet.