Six months after Mythos: behind the predicted “vulnapocalypse,” the reality of “vuln fatigue”

Guillaume CHÉREAU, 26 October 2026

The two critical PHP vulnerabilities patched on 21 October illustrate a risk less spectacular than a widespread collapse: that of organizations worn down by successive emergencies, in a fog of sometimes contradictory information. The ability to hold out over time is becoming a resilience issue.

After the fear of the flood, the test of repetition

On 7 April 2026, Anthropic presented the cybersecurity capabilities of Claude Mythos Preview: discovering old and complex vulnerabilities, then building ways to exploit them. Enough to fuel fears of a “vulnapocalypse,” a flood of flaws that would outpace defenders. Six months on, the PHP episode suggests another scenario: a succession of critical alerts, close enough together to exhaust teams without necessarily causing a global catastrophe.[1]

On 20 and 21 October, two vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619, put organizations on alert. Rated 9.2 under CVSS 4.0, they can allow unauthenticated remote code execution. Patches were released on 21 October, and CERT-FR recommended isolating affected equipment before updating it. The urgency was justified. These are essential recommendations, but implementing them still requires each organization to precisely assess its exposure, identify the systems concerned, coordinate remediation actions and weigh the potential impact on business continuity.[2] [3]

AI speeds up discovery, not the whole response

According to the PHP Foundation, the first signs of one of the issues had been spotted as early as 2024, following an audit by Quarkslab. Fixing it, however, raised complex compatibility trade-offs, in a context of limited resources. Research carried out during summer 2026, notably with the help of AI, clarified the exploitation possibilities and accelerated the fix.[4]

AI can shorten the path between a software weakness and the demonstration of how dangerous it is. It does not turn the trade-offs needed to fix it, test the solution and deploy it across heterogeneous environments into instant decisions. Part of the risk lies in this speed gap.

Deciding in the information fog

The PHP episode also illustrates how hard it is to obtain reliable information in time: CVE identifiers circulating with an incorrect score, accidental publication of a demonstration video, disrupted coordinated disclosure. On 25 October, Unit 42[5] even withdrew an earlier communication: a compromise had been observed, but its link to the two PHP flaws could not be confirmed.[6] [7]

For defense teams, these distinctions are essential. Between the publication of exploit code and the reality of a compromise, several elements must be verified: the reliability of the exploit, the configurations that are actually vulnerable, whether successful exploitation attempts exist, and the availability of patches suited to the deployed versions. All uncertainties that must be quickly resolved to assess the organization’s real exposure, prioritize protective measures and inform executive leadership’s decisions.

This assessment work represents a considerable burden. As early as 14 October, the PHP security team reported having published fifteen CVEs since 1 July, while having had to process and close 106 invalid, duplicate or non-reproducible reports. AI is helping to widen this imbalance: while it makes it possible to generate submissions at scale and reports at lower cost, analyzing, verifying and triaging them still takes significant time and human expertise.[8] One emergency can hide several others.

A vulnerability in such a widespread building block goes beyond the websites immediately identified as using PHP. It requires questioning hosting providers, software vendors and equipment suppliers. Palo Alto Networks, for instance, published a bulletin covering, among others, PAN-OS management interfaces, with patch schedules specific to each branch. The availability of the PHP patch therefore does not mean that all of an organization’s dependencies are immediately addressed.[9]

It is in this succession of alerts and emergency mobilizations that “vuln fatigue” gradually sets in: a form of wear on teams faced with ever more frequent demands, without necessarily having been able to finish handling previous vulnerabilities, let alone take the time to draw lessons from them through a genuine post-incident review. Emergencies pile up, the same experts are mobilized, long-term projects are slowed or interrupted, and trade-offs must be made amid persistent uncertainty. Over time, it is organizations’ very ability to distinguish true priorities that risks eroding.

The risk is that attention declines, checks get shorter and unfinished situations accumulate. This episode alone does not demonstrate a general trend, nor does it rule out a future major shock. It does, however, give substance to a scenario worth preparing for: recurring emergencies whose organizational consequences add up.

Organizing for the long haul, protecting teams

Not every critical vulnerability justifies activating a crisis cell, whether operational or decision-making. Each alert, however, must be met with clear responsibilities, escalation criteria and a tracking method. Who assesses exposure? Who decides on a service interruption? Who follows up with suppliers? Who verifies fixes and decides on the return to normal operations?

Continuity between mobilizations must also be preserved: recording decisions and their rationale, handing over files during shift changes, tracking residual risks and reusing lessons learned. Exercises and post-incident reviews play an essential role here: they strengthen teams’ ability to cope with protracted crises, manage several emergencies simultaneously and maintain their operational effectiveness despite accumulating demands.

The multiplication of incidents calls for stronger coordination, a smooth flow of information and rigorous traceability of decisions and actions taken. This is the thinking behind Crisis Cockpit, which we developed at Alcyconie: a collaborative platform designed to facilitate the steering of incidents and crises, share a common view of the situation and ensure continuity of actions, even when emergencies follow one another. AI and automation also help lighten teams’ workload, allowing them to focus on what matters most: analyzing, deciding and acting.

As vulnerability discovery accelerates, resilience will also depend on our ability to preserve attention, organize handovers and complete the actions under way.

Knowing how to respond to an emergency is essential. Being able to hold out through repeated emergencies is decisive.

---

[1] Anthropic: Claude Mythos Preview’s cybersecurity capabilities, 7 April 2026

[2] PHP: Security announcements of 20 and 21 October 2026

[3] CERT-FR: Alert CERTFR-2026-ALE-014, updated 22 October 2026 (in French)

[4] PHP Foundation: Today’s PHP Security Release, 21 October 2026

[5] Unit 42 is the global threat intelligence, incident response and cybersecurity consulting team of Palo Alto Networks

[6] PHP Foundation: Today’s PHP Security Release, 21 October 2026

[7] Unit 42: PHP Threat Brief, updated 25 October 2026

[8] PHP Foundation: How the PHP Security Team Handles Your Reports, 14 October 2026

[9] Palo Alto Networks: Security advisory CVE-2026-109618, updated 26 October 2026