Research for this post was AI-assisted; the argument, analysis, and final edit are my own.

A Flood of Boring Bugs

PHP2Shell sounds like a drink special. It is not a drink special. On October 17, 2026, someone started exploiting it anyway. The fix didn't ship until October 21, and proof-of-concept code was already circulating twelve hours before the embargo lifted. By the time most teams finished reading the advisory, Cloudflare was counting attack attempts in the millions against roughly 37 million exposed hosts (Moses, 2026; Lakshmanan, 2026). PHP2Shell wasn't a zero-day. It's a preview of how little a four-day patch window is worth once exploitation moves this fast. Good news: none of this calls for panic, just better plumbing.

Attacker Economics

An attacker runs a campaign when expected value is positive:

$$EV = p(\text{success}) \times \text{value} - \text{cost}$$

AI has spent the last two years driving that cost term toward zero. Finding a bug, writing an exploit, and turning it into something you can run at scale all got cheaper, and the trend hasn't slowed (Fang et al., 2024; Anthropic, 2026a; de Moor, 2026). That leaves defenders two levers, $p$ and $\text{value}$, owned by three teams that do not share a queue.

On the defender side the same economics show up as cost-to-find:

$$C_{\text{find}} = \frac{S_{\text{disc}} + R \cdot t_{\text{triage}}}{p \cdot R}$$

Discovery spend $S_{\text{disc}}$ is heading toward zero. Report volume $R$ is going up. Precision $p$ is going down. The only term that still costs real money is $t_{\text{triage}}$, the human hours per report (Stenberg, 2025; Pesoli et al., 2026).

The bottleneck moved from finding bugs to validating and fixing them (Anthropic, 2026b).

Cloud Security Is Now Infrastructure Security

Tim Gonda opened fwd:cloudsec Europe 2026 with "Cloud Security Is Dead. Long Live Infrastructure Security." (Gonda, 2026). His point is not that cloud controls stopped mattering. At mature organizations the playbook worked: lock down the CI/CD pipeline, watch for misconfigurations, put guardrails in front of mistakes, and auto-remediate what slips through. So the residual risk moved into application code, AI pipelines, and supply chains, and into what he called "the seams of organizational responsibility."

Who is Tim Gonda

Tim Gonda has worked cloud security from every side: building infrastructure, defending it in SOC and Fortune 500 security programs, attacking it as an offensive security director, and now leading cloud security engineering at Datadog, where he co-authored the company's public security playbook. When he says the old playbook is finished, it's not a hot take from the sidelines; it's a verdict from someone who's played all four positions.

The incident record agrees. Storm-0558 started with a signing key in a crash dump. tj-actions started with a bot token. Nx s1ngularity started with three ordinary CI misconfigurations. Salesloft Drift went GitHub account to AWS to customer OAuth tokens. Shai-Hulud rode maintainer identity and publish automation (Waldman, 2024; Bar et al., 2025; Strumpflohner, 2025; Lakshmanan, 2025; Check Point Research, 2025). The cloud was the destination every time, never the entry point. Whoever owns identity on the control plane owns the outcome.

That's why access hardening ranks first in the bugonomics ROI analysis I'll publish in the first half of 2027. When the cheapest attack is a stolen token, $p$ and $\text{value}$ are set by infrastructure, not application code (Mogull & Farris, 2024; Google Cloud, 2025).

If You Can't Check Those Boxes, Cloud Security Isn't Dead for You

Gonda's claim has a precondition. It holds if you've already locked down the pipeline, you catch misconfigurations, your guardrails block instead of just alert, and broken things fix themselves without a ticket. Then, in Gonda's own framing, posture is solved and the risk moves to the seams.

Most organizations are not there, and the numbers that matter are not moving (Datadog, 2025b):

Metric Value Trend
AWS IAM users with an access key older than a year 59% unchanged from 2024
IAM keys older than three years 25% up from 21%
Organizations with any data perimeter 40% —
SCPs used as a perimeter 0.6% —
RCPs used as a perimeter 0.1% —
Regional IMDSv2 default switched on under 3% pushes enforcement above 95% wherever it's on
EC2 instances overprivileged 19.4% flat from 19%
Overprivileged third-party roles 12.2% up from 10%

What did move, moved because of a default: new instances enforce IMDSv2, old ones do not, and 83% of S3 buckets sit behind a public access block. Left to the organization, the number stays put. Most cloud breaches still start with a compromised credential (Tafani-Dereeper, 2025).

That's the playbook unfinished, not obsolete. The attacker's cost just dropped. The blast radius of your four-year-old key did not. You don't get to skip to the seams.

"Cloud security is only dead if you already did the work. If you've got year-old keys and no guardrails, you're not at the funeral. You're the body."

— Andrew Krug

AI Made It Multi-Incident per Day

"Multi-incident per day" depends on what you count, so say what you count. In-the-wild zero-days have not moved: Google counts 90 for 2025 and a 60 to 100 band for years (Google Threat Intelligence Group, 2026). That's one every four days, and anyone claiming "a zero-day a day" is using the wrong number.

The honest unit is a CVE with first-known in-the-wild exploitation. VulnCheck counted 884 in 2025, about 2.4 a day, and 495 in the first half of 2026, about 2.7 a day (VulnCheck, 2026a, 2026b). Nearly a third were exploited on or before publication day. CISA KEV catches a fraction of them.

Why "in the wild" matters

CVSS tells you how bad a bug could be in theory. In-the-wild exploitation tells you someone already decided it's worth using, against a real target, today. That's the line between a finding and an incident, and it's the signal EPSS and detection telemetry are built to catch. A severity score can't see it; a sensor can.

The bigger change is velocity. Mandiant's mean time-to-exploit is now negative seven days, and time from initial access to hand-off fell from eight hours in 2022 to 22 seconds in 2025 (Mandiant, 2026; CrowdStrike, 2026). Median time from CVE publication to exploitation dropped from 120 days to 80 in a year (VulnCheck, 2026b). Two or three exploited CVEs a day is survivable. Two or three a day that are live before the patch exists is not, unless detection does the work patching used to do.

AI isn't producing more zero-days; GTIG didn't attribute a single 2025 zero-day to AI (Google Threat Intelligence Group, 2026). What it's doing is inflating the denominator. CVE volume went from 25,000 in 2022 to 48,000 in 2025 and is tracking toward 66,000 in 2026 (Gamblin, 2026a, 2026b; Gamblin & Leverett, 2026). Of 1,061 CVEs credited to AI-assisted discovery in the first half of 2026, 14 were exploited, the same rate as everything else (VulnCheck, 2026b). The firehose feeds the triage problem, and triage is where the economics bite.

Daily rates by unit, 2025:

  • CVEs published: 132/day
  • CVEs with first exploitation evidence: 2.4/day
  • KEV additions: 0.67/day
  • In-the-wild zero-days: one every 4 days
  • Human-triaged malicious packages: 39/day

The Vulnpocalypse Needs Tighter Loops

Each term in the equation has an owner. AppSec owns $\text{cost}$: exploit prevention and patch velocity. Cloud Security owns $\text{value}$: how little access an attacker gets, how far they can spread from there, and whether the target is even reachable in the first place. Detection owns $p$: it shortens the window and tells everyone what is actually being hit. When AI pushes $\text{cost}$ to zero, the game is $p$ and $\text{value}$, so Detection and Cloud Security set AppSec's priorities, not CVSS.

About 6% of published CVEs have ever been exploited, and EPSS, built from detection telemetry, catches 93% of actually-exploited CVEs for the same investigation budget that gets CVSS only 37% (Cyentia Institute, 2024; Jacobs, 2025). Only 18% of CVSS-critical findings stay critical once you check whether the system is actually in production and reachable from the internet, and Wiz finds that check removes more than half of high-priority findings (Datadog, 2025a; Wiz, 2026b). 77% of organizations need more than a week to ship a critical patch while time-to-exploit is negative (Cloud Security Alliance, 2026a; Mandiant, 2026). Patch SLA cannot close that gap. The loops can.

The loops that are missing:

  • Detection to AppSec: exploitation status drives patch priority, not CVSS. EPSS already pulls in signals from honeypots, intrusion detection, and endpoint tools. The question is whether your own detections feed your own prioritization.
  • Cloud inventory to AppSec: a CVE on an unreachable workload with a scoped role is not the same CVE as one on an internet-facing host with a year-old admin key. The 18% number is this loop working.
  • AppSec to Detection: every accepted finding ships with a detection, not just a ticket. No published source spells this out; it follows from the other three loops working.
  • Shared triage: validation hours are the scarce resource in the $C_{\text{find}}$ denominator. Three separate triage queues is how an 800 USD validation floor becomes 2,400 USD.

Feedback

The four levers in the bugonomics model are access hardening, exploit prevention, least privilege, and observability. Stack them and attacker expected value crosses zero. No one of the three teams owns more than two. That's the argument for the feedback loop: not because collaboration is nice, but because the equation doesn't go negative any other way. Share the queue, and the math finally works in your favor for once.

Methodology

How the numbers were built, with receipts. Full analysis, data, and notebook land in the first half of 2027. I'd rather ship it right than ship it now.

References