Charles Henderson
EVP, Cyber Security Services, Coalfire
Charles Henderson is a seasoned executive who specializes in leading teams that test, monitor, respond to, and secure organizations around the world.
The AI vulnerability apocalypse is here – or is it? The hype certainly is
We’ve been busy building some fantastic things at DivisionHex. But every once in a while, the security headlines get so wild, I get to write one of these blogs.
First off, there is no AI vulnerability apocalypse. When the PHP2Shell vulnerabilities made headlines in October 2026, many organizations ended up in vulnerability war rooms (or as I like to call them, “hacker socials”). Some didn’t. But probably not for the reason you think.
But I’ll get to that in a minute; first I want to explain something about vulnerabilities and the use of AI to find them and write exploits. Vulnerability discovery has been a thing for a long time. It’s one of the oldest ways for hackers to get street cred. AI isn’t doing anything new, and it isn’t necessarily lowering the barrier to entry either. What it assists with most is enabling expert researchers to do their thing faster.
In fact, by October 2026, DivisionHex’s Adversary Services team’s custom LLM pipeline had enabled them to identify vulnerabilities and develop working exploits in one tenth the time it had taken a year earlier. Like others, we were in the middle of responsible disclosure for those vulnerabilities at the time.
What AI doesn’t do is enable random script kiddies to turn into Abby from NCIS, where you can randomly mash buttons on keyboards to get around firewalls (zoom, enhance!). Some researchers pointed out at the time that exploitation difficulty was really not that straightforward, and that, like everything else related to AI, hype was out of control.
And while everyone should absolutely patch vulnerabilities affecting their environments, I want to go back to those organizations that don’t get overwhelmed by vulnerability war rooms. It’s not because they don’t care. It’s because they prepared. This isn’t their first rodeo. Their exposure management policies, processes, and technology are so honed that security events like PHP2Shell (or the Node.js RCE, or eMudhra’s certificate failure, and the list goes on) are just another day.
The other trait I’ve seen in our most successful client security programs is proactive defense. Specifically threat hunting. Reports of repeated breaches and a compromise that went undetected for more than four months show why that matters. When you’re proactively threat hunting, events like that are exceedingly rare. And to be clear, there are a lot of organizations that kick off threat hunts in response to a major vulnerability disclosure. But the most prepared teams have them built into their regular security processes. Those are the groups you don’t read about in the news.
So as the headlines keep coming, a final reminder from me that you aren’t alone. We’re in this together, and as I tell my team: together, we can fear no future.