Patching fast: why every day counts now AI is in the picture

Disclosing a vulnerability is the starting gun for attackers. And that gun is a lot louder now than it was a few years ago.

What is patching, and why do we do it?

Software contains flaws, even software from big vendors. When such a flaw affects security, the vendor releases an update: a patch. Install that patch and you close the back door. Wait, and you leave it open.

Before, you had time. Now you don't.

There used to be weeks or even months between a patch appearing and the first attacks. An attacker first had to work out what exactly had been fixed and then build a working attack for it. That took specialist knowledge and a lot of time.

That time has been shrinking for years. Researchers at Mandiant saw the average time-to-exploit fall from 63 days in 2018 and 2019 to 5 days in 2023. And according to VulnCheck, in the first half of 2025 almost a third of exploited vulnerabilities were exploited within a day of disclosure, or even before it.

AI speeds this up even further:

• Picking patches apart is faster. AI helps compare what changed in an update, and so where the weak spot was.
• Writing attack code takes less time and knowledge. With help from AI, a working attack comes within reach sooner, even for attackers who are not top experts.
• Hunting for victims is faster still. Attackers have been scanning the internet automatically for years for systems that have not been patched yet. If the attack is ready sooner, those systems are next in line sooner too.

The result is that the time between "patch available" and "attack launched" keeps getting shorter. Your window to act is shrinking.

Three critical vulnerabilities in just over a week

That this is not theoretical became clear in mid-October. In just over a week, three critical vulnerabilities came to light: in firewalls, in web servers and in virtualisation software. Three completely different systems, all critical and all found with the help of AI. That is no longer a coincidence; it is the new normal.

The firewall: Fortinet (22 October). Fortinet released updates for products including FortiOS, the operating system of the FortiGate firewall. These covered critical and high-severity vulnerabilities, which Fortinet says it found with the help of AI. Fortinet asked customers to give the updates priority, starting with internet-facing devices. Fortinet will publish the technical details on 10 November. We emailed the customers concerned straight away and arranged the restart with them.

The website: PHP2Shell (21 October). PHP is the programming language behind a large share of all websites, including many WordPress sites. Two critical flaws allowed someone to run code on a web server without logging in. Almost all PHP versions since 2012 are affected. Here too, the researchers used AI. Five days after the patch, the US Cybersecurity and Infrastructure Security Agency (CISA) put the flaws on its list of actively exploited vulnerabilities. There were even attack attempts before the patch was out.

The server: PwnEscape (mid-October). A single physical server often runs several virtual machines side by side, for example on the widely used Proxmox platform. A flaw in Linux allowed a virtual machine to break out onto the physical server beneath it and so reach the other virtual machines. According to the researcher, this flaw was also found with the help of AI. The fix: update the server and reboot it.

Three flaws that have nothing to do with each other, in three different layers: the network, the website and the server. You cannot let them all wait for the next monthly patch cycle.

Read more: the Tweakers news report on Fortinet (in Dutch), Help Net Security on PHP2Shell or The Register on PwnEscape.

What does this mean for your organisation?

A monthly patch cycle is still normal for many businesses. For critical vulnerabilities it is no longer enough. Microsoft and other vendors regularly release emergency (out-of-band) updates outside their regular monthly cycle. Think of them as emergency plasters: you apply them straight away, not at the next scheduled cycle.

Systems that can be reached from the internet in particular need updating quickly. Think of firewalls, mail servers, websites and VPN access: the secure connection you use to log in from outside.

A few questions to ask yourself:

• Do you know what you have? You can only patch what you know about. An up-to-date overview of systems and software is step one.
• Do you know what comes first? Not everything is equally urgent. Start with what can be reached from outside and with vulnerabilities that are already being actively exploited.
• Who does it, and when? Agree who applies a critical patch within a few days, also outside the regular maintenance window.
• What is off the radar? Think of old servers, equipment on site and software nobody manages any more.

How we go about it

Where possible, we roll out updates automatically after a short grace period. That way no time is lost. We keep workstations up to date automatically as far as we can. Servers we update in a controlled and planned way, because more depends on them.

Patching is not a one-off job but a habit

The best defence is a fixed, calm routine: an overview, priorities, a fast route for urgent updates and a regular cycle for the rest. Then you do not have to panic when a new vulnerability appears.

The law comes into play too. Since 15 August 2026, NIS2 has applied in the Netherlands as the Cyberbeveiligingswet (the Dutch Cybersecurity Act). If your organisation falls under it, you must be able to show that you manage vulnerabilities. Those organisations increasingly ask the same of their suppliers. Patching quickly and in a structured way therefore helps you even if you are not covered by the law yourself. Take a look at Smart Compliance for help with NIS2.

Need help?

Infodatek Group handles patch management for customers as part of Cybersecurity and Digital Care. We are happy to look at how you currently handle patching and where it could be faster and smarter.