Quevin

I Thought Security Was the CISO's Job. I'm the First Line of Defence.

Kevin P. Davison
AI Security Leadership
I Thought Security Was the CISO's Job. I'm the First Line of Defence.

I had always filed security strategy under the CISO’s job. Last week sent me to the model that job is built on, and it says otherwise: the first line of defence is the people who run the service. I lead a web platform. The first line is me.

That matters more this month than last. When the PHP2Shell vulnerabilities went public on October 21, the NSA and Japan’s prime minister told organizations to patch immediately or take unpatchable services down, and 4chan, several Wikimedia services and Archive.org went dark to do it (404 Media). Those outages weren’t the attack. They were the response.

That is the part of the COVID comparison that holds: the disruption you notice in a pandemic is mostly the quarantine, not the virus. If AI keeps finding decade-old bugs faster than maintainers can ship fixes, the internet won’t fall over once. It will go quiet service by service while the people who run each one patch. Whether a given service goes quiet or gets breached depends on those people.

Black October was a discovery problem

The bugs weren’t new. They were newly found. CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS v4.0 (the standard 0-to-10 severity scale), allow unauthenticated remote code execution in code that, in the PHP Foundation’s words, “nearly every request touches” (The Record). One of them was identified in PHP’s 2024 external audit and not acted on. Researchers using AI tools from Anthropic and OpenAI scanned PHP’s code earlier this year, and OpenAI, Wiz and Trail of Bits each found the same flaws independently.

The same day, Node.js shipped fixes for ten vulnerabilities, including a remote-code-execution bug in its bundled Brotli decoder, with no fix at all for Node 20 and older (The Hacker News). LiteLLM packages were poisoned on PyPI and Docker Hub, and an Indian certificate authority lost its private keys (TechCrunch). TechCrunch notes these were unrelated. That’s the uncomfortable part: nobody had to coordinate anything for the week to look like this.

Cloudflare’s CEO Matthew Prince posted the curve. Thousands of exploit attempts across Cloudflare’s network in the ten hours before the announcement, tens of thousands in the 45 minutes after, hundreds of thousands within two hours, then millions (404 Media, above). The window between “disclosed” and “everyone is trying it” is now shorter than a meeting.

The bottleneck is a handful of people

The PHP Foundation has one permanent employee, Executive Director Elizabeth Barron, plus 14 mostly part-time contractors, according to Reuters as reported by Techzine. Proposed code changes nearly doubled last year. Reviewers didn’t.

The security team’s own account, published a week before the disclosure, says AI has made security reports “much cheaper to write” and that php-src “gets far more of them than it used to” (PHP Foundation). Since July 1 they have published 15 CVEs and closed 106 reports as duplicates, non-issues or non-reproducible. Every one of those 106 cost a human time to rule out. Finding got cheap and checking didn’t, which is the same split I keep hitting with my own AI output.

I’ve spent most of my career on Drupal, which means most of my career on PHP. Who maintains the engine underneath? I never asked. Not asking is the arrangement open source makes possible and the arrangement that breaks first when finding bugs gets cheap and fixing them doesn’t. Vernor Vinge wrote about this in A Deepness in the Sky: a civilization whose software is so many layers deep that “programmer-archaeologists” dig through millennia of code nobody remembers writing. PHP is thirty years old. The archaeology just got automated on the finding side and not on the fixing side.

The first line is the people who run the thing

The Three Lines of Defence model, introduced by the Institute of Internal Auditors in 2013 and revised in 2020, splits responsibility for risk into three groups (BDO):

  1. Operational management, which owns the risk and designs and runs the controls that reduce it.
  2. Risk and compliance functions, which set policy and watch whether the first line is following it. The CISO’s office mostly lives here.
  3. Internal audit, which independently checks the whole arrangement and reports to the board.

“Operational management control of organisational risks” sounds like a phrase written to be skipped. Translated: the team that builds and operates a service is responsible for its security, not a separate department. The developers who pin the PHP version, the platform lead who decides patch windows, the manager who approves the sprint that does or doesn’t include the upgrade. Those people are the control.

I’m the platform lead in that sentence. I pick the versions, I argue for the upgrade tickets, I have deploy access, and I’m the person someone asks “are we exposed?” the morning a 9.2 lands. The CISO’s policy describes what I’m supposed to do with the risk. It doesn’t take the risk off my desk.

The 2020 revision dropped “Defence” from the name and said the lines work concurrently, not in sequence. In the old reading, I could treat security as something that happens downstream: we ship, security reviews, audit checks. In the new reading, the CISO can write the best policy in the world, and if I can’t patch PHP the afternoon a 9.2 lands, the policy is a document.

GMO is what a missing first line looks like

GMO Internet Group’s CEO, Masatoshi Kumagai, admitted on Sunday that the company’s own white-hat engineers had flagged “issues that needed improvement” before attackers got into its onamae.com desktop cloud service, and that the response was inadequate “in both depth and speed” (Japan Today / Kyodo). Nothing reported so far ties the breach to PHP2Shell; it’s a separate failure with the same shape.

The detection worked. The warning existed, inside the company, from the right people. What failed was the part the model assigns to operational management: turning a known risk into a changed system before someone else used it. Kumagai’s blog post is a first-line admission made by the person at the top, after the fact. I’d rather make mine before.

The strongest case against all of this

This is Heartbleed with better marketing. The internet survived Heartbleed, Log4Shell and Y2K, and each came with a headline promising the end. PHP shipped fixed releases for every supported branch the day of disclosure, with source patches back to 7.4. Hosts like SiteGround put mitigations in place hours before the release. The PHP Foundation says it has found no evidence of exploitation before disclosure. And the same AI that finds the bugs is triaging them: the PHP security team uses OpenAI’s Daybreak Red and Anthropic’s Claude Mythos to validate reports, with a human setting severity and reviewing every patch. Defenders get the tools too, and defenders have the source code.

All true, and it’s the reason I don’t think “collapse” is the right word. But every item on that list is a first-line action. Each is someone who runs the thing taking the risk as theirs. The case against panic is the case for the first line. It doesn’t help an organization whose first line thinks security lives in another department.

What owning it looks like

This is my list, starting with my own platform.

Measure patch latency, not patch policy. The number I should be able to say out loud is hours from disclosure to production for a critical CVE in a dependency we didn’t write. If I can’t say it, that’s the finding. In the pipeline I’m building, every change lands on a pull request, so the number should fall out of the deploy timestamps.

Know what I run. You can’t patch Node 20 if you don’t know three services still use it, and there is no patch for Node 20 coming. An inventory of runtimes and versions is boring and it is the whole first step.

Shrink the touch points, but don’t rewrite for it. Earlier this month I took an end-of-life Drupal 7 site, one with a text format that still executed PHP, to plain static files in two days. It was a migration, not a security project. This week it reads as the second thing: there’s no PHP left on it to patch. That fits a small marketing site. It doesn’t fit a commerce platform. The test is narrower: for every place a request from the internet reaches code we execute, does that path need to exist?

Rehearse the off switch before buying redundancy. Duplicating every service on the same stack gives you two copies of the same bug. What 4chan and Archive.org had last week was the ability to go dark on purpose, patch, and come back. A maintenance page, a read-only mode, a written decision about who’s allowed to pull the plug. It’s also what the guidance asked for.

Fund upstream, a little. If your business runs on PHP, the PHP Foundation’s donation page is a security line item, not charity.

What made the difference in 2020 wasn’t a single hospital. It was whether each place had people who considered the response theirs on the day the guidance changed. AI has made the guidance change faster. On my platform, the person it changes for is me.

Resources

Kevin P. Davison

About the Author

Kevin P. Davison has over 20 years of experience building websites and figuring out how to make large-scale web projects actually work. He writes about technology, AI, leadership lessons learned the hard way, and whatever else catches his attention—travel stories, weekend adventures in the Pacific Northwest like snorkeling in Puget Sound, or the occasional rabbit hole he couldn't resist.

Learn More → LinkedIn →