Last week was terrible. It didn't have to be

Last week saw the arrival of two CVEs for PHP, CVE-2026-109618 and CVE-2026-109619, each rated a staggering CVSS 9.2. For comparison, Heartbleed was rated 5.0 under CVSS version 2 and 7.5 under version 3.1. Soon after the news landed, the cyber security team and others at work were setting up war room channels to patch immediately. It was a huge amount of work. We had to check each system to find its exact PHP version, then wait for patches to appear. Many vendors released at the time of the announcement. Others (cough Amazon cough) were slower, and we waited until around 10:30pm for theirs. Like many people, I read the announcement, saw the score and thought of several expletives. The pre-announcement was as close to "we're all going to die" as I've seen in a while. Major nations took their sites offline altogether. The coordinated response from Wiz, OpenAI and others fanned the flames. Even the prime minister of Japan sounded the alarm. A 9.2 should raise alarm bells. But having dug…