Last week is the new normal. Wednesday to Sunday: eMudhra certs, PHP2Shell, Railway, Node2Shell/Brotli, Tailworm, and probably a couple more I've already forgotten. This is the AI vulnerability wave everyone was bracing for. These should have been non-events. If a service isn't exposed to the internet and you're patching weekly, you read the advisory and move on, confident that the service will be patched. So this is our first serious fire drill of AI vulnerabilities. Engineering and security teams can't scramble every time a bug gets a name and a logo. The answer is the basics, done consistently: 1) Shrink your attack surface. If it isn't customer-facing, it shouldn't be reachable without strong authentication. 2) Patch on a cadence, not in a crisis. Plan for containers and dependencies to update weekly. 3) Give everything you ship an owner. Unowned services are where patches go to die. Teams historically traded SDLC hygiene for speed and convenience. That trade just got a lot more expensive. And you need to figure out how to keep up with security at AI speed. How is your team handling the volume? Changing your patch cadence, or still running fire drills?