Patch in days, not seasons: keeping infrastructure updated in the age of AI
Security researchers are finding vulnerabilities faster than ever, and AI is a large part of the reason. AI models can read source code, generate test inputs at scale and flag suspicious patterns in software that humans have reviewed for years without noticing anything. The result is a steady rise in disclosed vulnerabilities, including in mature, widely used open-source components that sit inside almost every piece of infrastructure.
For IT teams, that means more patches arriving more often, while attackers using the same tools need less time to turn each disclosure into a working attack. The past ten days are a case in point.
Two critical flaws in PHP, CVE-2026-109618 and CVE-2026-109619, together known as PHP2Shell, were disclosed on 21 October. In the same week came CVE-2026-114406, a compromise of certificate authorities run by eMudhra. Today, Syneto released security-only updates in response: Syneto OS 5.4.5 and Syneto OS 6.0.6 fix both issues, and so do updated PHP packages and an updated certificate bundle for Syneto OS 4.8.6.
What happened
Both PHP flaws are rated 9.2 (Critical) under CVSS v4.0 and allow unauthenticated remote code execution: anyone who can reach the web server can run code on it. They affect PHP-FPM, which runs parts of the Syneto OS management interface on every Syneto OS line. Within five days, CISA added both to its catalogue of vulnerabilities known to be exploited.
The eMudhra issue is different in kind: the keys of several of its certificate authorities were found to be recoverable, so anyone holding them could issue a convincing certificate for any website. Today's updates remove trust in those authorities.
Timeline, October 2026: PHP discloses PHP2Shell on 21 October; compromised eMudhra certificate authorities are distrusted on 23 October; CISA adds both PHP flaws to its Known Exploited Vulnerabilities catalogue on 26 October, five days after disclosure.
Neither issue was in Syneto's own code. Hypervisors, storage systems, firewalls and backup appliances all rely on the same open-source building blocks: the Linux kernel, OpenSSL, PHP and the list of trusted certificate authorities. A flaw in one of them shows up in hundreds of products at once.
Why twice-a-year patching is over
Many organisations still update core infrastructure in one or two planned windows a year. That was reasonable when exploits took months to appear. Today an AI model can compare a patched release with the previous one and work out what was fixed, so a published fix quickly becomes a working attack. Patch twice a year, and a system spends most of the time between windows with a known, actively exploited flaw.
Illustrative year: with patches twice a year (April and October windows), systems stay exposed to known critical vulnerabilities for months; with a standing window and emergency hotfixes, each exposure lasts only a few days.
The trade-off is now simple. On one side is an upgrade: minutes for a hotfix like this one, tens of minutes when a reboot is needed. On the other is a door left open on the system that matters most.
Syneto OS is a universal, resilient data management platform with an HCI architecture: one system runs the virtual machines, holds their data and protects it. That makes it a valuable target, but it also means one upgrade cycle and one console, instead of separate cycles for the hypervisor, the storage array and the backup software.
How to reduce your exposure
Know whether you can patch fast. Ask honestly how long your team would need to roll out a critical fix across every system it runs, and what would slow it down: skills, access, maintenance windows or approvals. Make sure everyone who manages infrastructure understands the risk of leaving systems out of date. If the skills or the time are not available in-house, engage a system integrator who can take on the job.
Shrink what attackers can see. Keep management consoles off the internet, behind a VPN or an IP allow-list. This does not replace patching, but it buys time. To find out what is actually exposed, Syneto partner Orizon offers RECON Essentials, an external attack-surface scan that finds forgotten subdomains, open ports, the software versions behind them, their known CVEs, and weak DNS and email settings. Integrators can run it across customers' domains to find consoles that should never have been public.
Speed up your move to Syneto OS 6. Syneto OS 4 is still maintained, as today's update shows, but it is built on technologies that the industry is gradually replacing, which makes every fix harder to produce. Syneto OS 6 is built on current technologies and adds capabilities that Syneto OS 4 does not have. If you or your customers still run Syneto OS 4, plan the move now rather than waiting for the next critical flaw.
Make patching routine:
- Subscribe to security advisories from every infrastructure vendor you run.
- Keep a standing monthly maintenance window, so an urgent update is routine work, not a project.
- When a flaw lands in CISA’s catalogue, patch within days.
- Keep one list of which version runs where.
- After upgrading, check the version, the services and console access.
What to do now
Update Syneto OS 5.x to 5.4.5 and Syneto OS 6.x to 6.0.6, and apply the PHP and certificate bundle updates on 4.8.6. If you have questions or need help planning an upgrade, contact Syneto support.
Sources: php.net security advisory · Rapid7 · Tenable FAQ · Rocky Linux RLSA-2026:88459 · eMudhra incident page