SecOraLens
CriticalZero-Day

Cogent Security Makes the Fortune Cyber 60 for a Second Year, With a Plan to Run Cyber Defense Like a Factory

Cyber Security News·Source published ·1 min read

What happened?

San Francisco, CA, November 3rd, 2026, CyberNewswire Cogent Security, an applied AI cybersecurity company, reported that the PHP2Shell vulnerability exposed significant gaps in enterprise vulnerability response. Disclosed on October 21, PHP2Shell involved two critical flaws that had remained in PHP for more than a decade. AI-assisted research helped identify the vulnerabilities and develop working exploits in approximately one week, with attacks beginning before a patch was available. Cloudflare recorded millions of exploitation attempts that day.

Key details

  • Cogent Security named to Fortune Cyber 60 for second consecutive year as applied AI cybersecurity company.
  • PHP2Shell vulnerability disclosed October 21 involved two critical PHP flaws existing over a decade.
  • AI-assisted research identified PHP2Shell vulnerabilities and developed working exploits in approximately one week.
  • Average Fortune 500 company patched fewer than 1% of 2,266 affected assets by 5 p.m. Pacific on disclosure day.
  • Cogent's Zero Day Response mapped vulnerable assets across customer environments in average five minutes during PHP2Shell.
  • Cogent trains and deploys its own frontier reasoning model VR-1 for security use cases, outperforming general-purpose models.

Affected

  • Fortune 500 companies with 2,266 affected assets on average.

Fixes and mitigations

  1. Cogent agents carry out supported fixes autonomously within customer-defined autonomy zones.

What to look for

  • Cloudflare recorded millions of exploitation attempts on PHP2Shell disclosure day.
  • Google M-Trends 2026 reports mean time to exploit at negative seven days.
  • AI producing working exploits for new vulnerabilities in about 15 minutes at roughly a dollar each.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.