By Corey Hirsch, CISO at Teledyne Technologies and M.S. in Enterprise Risk Management (ERM) part-time lecturer
The lyrics to Coldplay’s “Viva la Vida” capture the challenge cyber defenders face amid the PHP vulnerabilities: “Castles stand upon pillars of salt, and pillars of sand.”
Two initial Common Vulnerabilities and Exposures (CVEs) became public on Oct. 20, and a third was published days later, posing threats to the estimated 70% of websites globally that use PHP. As of Oct. 31, approximately 32 million services reporting potentially vulnerable PHP versions remained visible on the public internet. These are a fraction of vulnerable instances under threat, however, because PHP (PHP: Hypertext Preprocessor), a more than 30-year-old scripting language, is embedded in myriad devices, products and applications. The Cybersecurity and Infrastructure Security Agency (CISA) has added PHP2Shell to its Known Exploited Vulnerabilities Catalog, confirming that exploitation has occurred.
When Anthropic introduced its frontier large language model (LLM), Claude Mythos Preview, in April 2026, it became clear that the ability of such models to detect vulnerabilities in code would tilt the cybersecurity playing field strongly in favor of attackers.
Anthropic launched Project Glasswing to give defenders early access to Mythos, providing a critical head start to patch vulnerable code prior to exploitation, a process known as “coordinated disclosure.” Since then, hundreds of thousands of new vulnerabilities have been discovered by Mythos and its cousins, according to researchers. However, the coordination of the PHP2Shell disclosures was disrupted, giving attackers a dangerous head start.
Network defenders in organizations globally went into emergency-response mode on Oct. 20 and 21. Simply finding the vulnerable systems, websites and products was daunting. Patching them was even more difficult. Some governments and businesses took systems offline as a delaying tactic, reflecting the overwhelming challenge. Mythos and similar LLMs can not only find vulnerabilities at machine speed but also weaponize them and orchestrate attack campaigns at scale. The world of vulnerability management, a discipline under the umbrella of operational enterprise risk management, has been radically disrupted by these models.
Now, in the eighth week of the Cybersecurity Risk Management course I am teaching this semester, our cohort has noted that this PHP headline, though unusually pervasive, is hardly unique. In fact, we’ve had such topics to review in class each week, often more than one.
Digital transformation has set the stage perfectly for such dynamics; they are now systemically inevitable and occurring with ever-increasing frequency and severity. My castles (the internet and its more than 30 billion active connected devices) stand upon pillars of salt and pillars of sand.
The core benefit of digital design is design reuse. Following decades of design reuse, our software stacks currently contain deeply embedded vulnerable code. Our partners’ systems are similarly exposed and may introduce risk to the supply chain, requiring third-party risk management to bolster the castle’s pillars and add strength and resilience.
The “Mythos Effect” may eventually help us achieve a more robust internet; however, that future is surely several years away. Between now and then, business, risk and technology managers will need to find new ways, procedures and tools to subtract risk from the digital ecosystem to at least partially offset the massive infusion of new risk and multiplication of the attack surface these frontier LLMs have introduced. The reservoir of installed, embedded vulnerability is massive, and it may still be growing. Microsoft’s “Patch Tuesday” has addressed an all-time record number of vulnerabilities in four of the past five months.
The arrival of “Q-Day,” quantum computing’s disruption of asymmetric encryption protocols, will interact with and mutually amplify the LLM-driven security disruptions we are already encountering, such as PHP2Shell.
Risk management professionals will be needed to manage these dynamics. They will need a solid understanding of cybersecurity risk management principles to enumerate at-risk assets, map dependencies, prioritize remediations, manage supply chain exposure, help prepare continuity plans and support effective business response to any exploitation.
Views and opinions expressed here are those of the authors, and do not necessarily reflect the official position of Columbia University School of Professional Studies or Columbia University.
About the Program
The Master of Science in Enterprise Risk Management (ERM) program at Columbia University prepares graduates to inform better risk-reward decisions by providing a complete, robust, and integrated picture of both upside and downside volatility across an entire enterprise. For both the full-time and part-time options, students may take all their courses on Columbia’s New York City campus or choose the synchronous online class experience.
The application deadline for the M.S. in Enterprise Risk Management program is May 1. Learn more about the program here.
