Every October, Cyber Security Awareness Month comes around and we talk about the familiar things: phishing, passwords, MFA and staff awareness.
All important stuff, but if you've worked anywhere near IT or cyber security this October, you might feel like Vulnerability Awareness Month would have been a more appropriate name. It's certainly felt that way to me.
Over the last few weeks, security and IT teams have been running around trying to work out which vulnerabilities affect them, what's genuinely urgent, which systems need patching, and what can safely wait. The bigger question is whether October was unusually busy, or whether this is a glimpse of what's coming next; I suspect it's the latter.
October was busy. Very busy.
We've seen a steady stream of serious vulnerabilities affecting technology organisations rely on every day.
One of the most notable was PHP2Shell, involving two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. But PHP certainly wasn't alone. October also brought significant vulnerabilities affecting GitLab, Node.js and other widely used technologies.
For IT teams, the problem isn’t simply knowing a vulnerability exists. It’s working out whether you’re affected, where it sits, how exposed you are and how quickly you need to act.
For many teams, October has felt like a constant cycle of check the estate, understand the exposure, patch, verify, and then move onto the next one.
Then there's AI
This is where things get particularly interesting.
The PHP vulnerabilities weren't simply another couple of CVEs. AI was used as part of the research that uncovered flaws that had reportedly been sitting in PHP for more than a decade.
Think about that for a moment. Vulnerabilities can sit unnoticed in widely used software for years, until increasingly capable AI models start looking at the code differently. That's why the development of frontier AI matters so much to cyber security.
As these models become better at analysing code, identifying weaknesses and helping develop proof-of-concept exploits, we should expect more previously undiscovered vulnerabilities to come to light, and potentially much faster than we're used to. That's good news when defenders find them first. But the same capabilities won't only be available to defenders.
What we've experienced this October may start becoming much more normal. And if vulnerabilities are increasingly being discovered at machine speed, asking already stretched IT teams to simply run around patching faster isn't going to be a sustainable answer.
We need to get better at quickly understanding what we're running, whether we're affected, how exposed we are and which vulnerabilities genuinely need immediate attention.
We need to get better at prioritising
Not every critical vulnerability represents the same level of risk to every organisation.
A vulnerability being actively exploited on an internet-facing, business-critical server deserves very different treatment to the same vulnerability on an isolated system with mitigating controls around it. That's why organisations need to move beyond simply looking at CVE scores and long vulnerability reports.
The focus should be on understanding what you're running, where you're exposed and which vulnerabilities present the greatest real-world risk to your organisation.
So, what can organisations do?
There isn't going to be one magic tool that solves the problem, but there are some fundamentals that can make a big difference.
Know what you've got - Maintain good visibility of your devices, applications and internet-facing assets. When the next critical vulnerability lands, you want to answer "are we affected?" quickly.
Prioritise based on exposure - Focus on vulnerabilities that are being actively exploited, affect important assets or are exposed to attackers, rather than treating every vulnerability equally.
Move towards continuous visibility - Annual or quarterly vulnerability assessments provide useful snapshots, but your exposure can change overnight. Continuous vulnerability and exposure management can give teams a much clearer picture of where their risk sits.
Test, don't just scan - Vulnerability scanning helps identify potential weaknesses. Penetration testing goes further by helping establish whether weaknesses can actually be used to compromise your environment.
Use automation where it makes sense - If AI and automation are accelerating vulnerability discovery, defenders need to use the same advantages. Modern Exposure Management tools can help organisations continuously identify exposure, prioritise risk and reduce some of the manual work involved.
The objective isn't to replace security teams, it's to stop them spending their entire week chasing CVEs.
The lesson from October
October 2026 might turn out to have been an unusually busy month, or we might look back and realise it was a sign of how vulnerability management was beginning to change.
Either way, I think organisations should be asking themselves a few fairly simple questions:
- Do we know what we've got?
- Do we know where we're exposed?
- Can we identify which vulnerabilities genuinely matter?
- Can we remediate them quickly?
- Can we prove afterwards that we've fixed them?
As AI accelerates the discovery of new vulnerabilities, being able to answer those questions quickly is going to become increasingly important.
Cyber Security Awareness Month might be coming to an end. Vulnerability awareness certainly isn't.
